CVE-2023-50722

XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, there is a reflected XSS or also direct remote code execution vulnerability in the code for displaying configurable admin sections. The code that can be passed through a URL parameter is only executed when the user who is visiting the crafted URL has edit right on at least one configuration section. While any user of the wiki could easily create such a section, this vulnerability doesn't require the attacker to have an account or any access on the wiki. It is sufficient to trick any admin user of the XWiki installation to visit the crafted URL. This vulnerability allows full remote code execution with programming rights and thus impacts the confidentiality, integrity and availability of the whole XWiki installation. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1. The patch can be manually applied to the document `XWiki.ConfigurableClass`.

• CWE-79
• CWE-352
• CWE-79
• CWE-352

• https://github.com/xwiki/xwiki-platform/commit/5e14c8d08fd0c5b619833d35090b470aa4cb52b0Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cp3j-273x-3jxcPatch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21167Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/5e14c8d08fd0c5b619833d35090b470aa4cb52b0Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cp3j-273x-3jxcPatch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21167Patch, Vendor Advisory

Published

Dec 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50717NocoDB is software for building databases as spreadsheets. S…5.4
• CVE-2023-50718NocoDB is software for building databases as spreadsheets. P…6.5
• CVE-2023-50719XWiki Platform is a generic wiki platform. Starting in 7.2-m…7.5
• CVE-2023-5072Denial of Service in JSON-Java versions up to and including…7.5
• CVE-2023-50720XWiki Platform is a generic wiki platform. Prior to versions…5.3
• CVE-2023-50721XWiki Platform is a generic wiki platform. Starting in 4.5-r…8.8
• CVE-2023-50723XWiki Platform is a generic wiki platform. Starting in 2.3 a…8.8
• CVE-2023-50724Resque (pronounced like "rescue") is a Redis-backed library …6.1
• CVE-2023-50725Resque is a Redis-backed Ruby library for creating backgroun…6.1
• CVE-2023-50726Argo CD is a declarative, GitOps continuous delivery tool fo…6.4
• CVE-2023-50727Resque is a Redis-backed Ruby library for creating backgroun…6.1
• CVE-2023-50728octokit/webhooks is a GitHub webhook events toolset for Node…7.5