What’s Vulnerable › Vulnerabilities

CVE-2023-40572: XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-08-24 · updated 2026-06-17
• Weakness: CWE-352

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.

Affected products

• xwiki-platform: before 14.10.9; 15.0, 15.0-rc1, 15.1, 15.1-rc1, 15.2, 15.2-rc1 (+2) — fixed in 14.10.9

How to fix

Upgrade to a fixed version: xwiki-platform 14.10.9. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m
• https://jira.xwiki.org/browse/XWIKI-20849
• https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m
• https://jira.xwiki.org/browse/XWIKI-20849

Get alerted when CVE-2023-40572 or the next vulnerability affects your stack