CVE-2023-37914

    Dashboard / Vulnerabilities / CVE-2023-37914

    CVE-2023-37914

    Published: 17 Aug 2023Last Modified: 12 Aug 2026

    Summary: Privilege escalation (PR)/RCE from account through Invitation subject/message

    Details: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.WebHome` can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6. Users are advised to upgrade. Users unable to upgrade may manually apply the patch on `Invitation.InvitationCommon` and `Invitation.InvitationConfig`, but there are otherwise no known workarounds for this vulnerability.

    References: https://jira.xwiki.org/browse/XWIKI-20421, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37914.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7954-6m9q-gpvf, https://nvd.nist.gov/vuln/detail/CVE-2023-37914, https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -48ee3193230753aecf8a86d7c8ff3e8f869e8330

    Affected versions

    xwiki-commons-15.2-rc-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-37914 | CVE-DB