CVE-2023-32069

    Dashboard / Vulnerabilities / CVE-2023-32069

    CVE-2023-32069

    Published: 9 May 2023Last Modified: 12 Aug 2026

    Summary: XWiki Platform privilege escalation (PR)/RCE from account through class sheet

    Details: XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XWiki 15.0-rc-1 and 14.10.4. There are no known workarounds.

    References: https://jira.xwiki.org/browse/XWIKI-20566, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32069.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-36fm-j33w-c25f, https://nvd.nist.gov/vuln/detail/CVE-2023-32069, https://github.com/xwiki/xwiki-platform/commit/de72760d4a3e1e9be64a10660a0c19e9534e2ec4

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fa35b6745b39cd3fe89b95ac25b0a71f78f8839a
    Fixed -dfd0eff6a9f28f5a8840a5e4a51f0a24524c0280

    Affected versions

    3.3-milestone2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-32069 | CVE-DB