Skip to content
OpenAdvisories

Package · Maven

org.xwiki.platform:xwiki-platform-invitation-ui

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.9
    CVE-2023-37914

    Privilege escalation (PR)/RCE from account through Invitation subject/message

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.WebHome` can execute arbitrary script macros including Groovy and Python macros that allow remote code execution includi…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-invitation-ui Maven
  • Critical 9.9
    CVE-2023-35150 EPSS 78%

    XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming r…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-invitation-ui Maven
  • Critical 9.9
    CVE-2023-29518

    Code injection from view right using Invitation.InvitationCommon in xwiki-platform

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause …

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-invitation-ui Maven