Iniciar sesión
Deutsch English Español Polski
Crítica

XWiki Platform remote code execution from account via custom skins support

  • Publicada: 10.04.2024
  • Actualizado: 11.10.2026 13:20

Impact

Any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution.

To reproduce, as a user without edit, script or admin right, add an object of class XWiki.XWikiSkins to your profile. Name it whatever you want and set the Base Skin to flamingo. Add an object of class XWikiSkinFileOverrideClass and set the path to macros.vm and the content to:

#macro(mediumUserAvatar $username)
  #resizedUserAvatar($username 50)
  $services.logging.getLogger('Skin').error("I got programming: $services.security.authorization.hasAccess('programming')")
#end

Back to your profile, click Test this skin. Force a refresh, just in case. If the error "Skin - I got programming: true" gets logged, the installation is vulnerable.

Patches

This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1.

Workarounds

We're not aware of any workaround except upgrading.

References

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-oldcore >= 6.4-milestone-1, < 14.10.19, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.19, 15.5.4, 15.10-rc-1

Referencias

Puntuación CVSS 9.9/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Debilidad (CWE)
CWE-862
Plataforma
Java / Kotlin (Maven)
Paquete
org.xwiki.platform:xwiki-platform-oldcore
Publicada
10.04.2024
Actualizado
11.10.2026 13:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-cv55-v6rw-7r5v - CC BY 4.0

Historial de vulnerabilidades: org.xwiki.platform:xwiki-platform-oldcore

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (46) en el archivo
Entradas en total
46
Primera → última
09.2020 07.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Crítica 12
  • Alta 17
  • Media 15
  • Baja 2

Divulgaciones por año

Gravedad:
  1. XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+
    Alta CVE-2026-34151 < 17.10.5, >= 18.0.0-rc-1, < 18.2.0 17.10.5, 18.2.0
  2. XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
    Alta CVE-2026-33229 >= 17.0.0-rc-1, < 17.4.8, >= 17.5.0-rc-1, < 17.10.1 17.4.8, 17.10.1
  3. XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
    Alta CVE-2025-54125 >= 1.1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  4. XWiki leaks password hashes and other accessible password properties
    Alta CVE-2025-54124 >= 9.8-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  5. XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
    Alta CVE-2025-54385 >= 1.0, < 16.10.6, >= 17.0.0-rc1, < 17.3.0-rc-1 16.10.6, 17.3.0-rc-1
  6. XWiki allows remote code execution through preview of XClass changes in AWM editor
    Alta CVE-2025-49586 >= 7.2-milestone-2, < 16.4.7, >= 16.5.0-rc-1, < 16.10.3, >= 17.0.0-rc-1, < 17.0.0 16.4.7, 16.10.3, 17.0.0
  7. XWiki allows SQL injection in query endpoint of REST API with Oracle
    Crítica CVE-2024-56158 >= 1.0, < 15.10.16, >= 16.0.0-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.2 15.10.16, 16.4.7, 16.10.2
  8. org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
    Alta CVE-2025-32968 >= 1.6-milestone-1, < 15.10.16, >= 16.0.0-rc-1, < 16.4.6, >= 16.5.0-rc-1, < 16.10.1 15.10.16, 16.4.6, 16.10.1
  9. XWiki Platform allows XSS through XClass name in string properties
    Crítica · 9.0 CVE-2024-43400 >= 1.1.2, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  10. XWiki Platform allows remote code execution from user account
    Crítica · 9.0 CVE-2024-37899 >= 13.4.7, < 14.10.21, >= 13.10.3, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  11. XWiki Platform remote code execution from account via custom skins support esta entrada
    Crítica · 9.9 CVE-2024-31987 >= 6.4-milestone-1, < 14.10.19, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.19, 15.5.4, 15.10-rc-1
  12. XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
    Crítica · 9.9 CVE-2024-31981 >= 3.0.1, < 14.10.20, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.20, 15.5.4, 15.10-rc-1
  13. XWiki has no right protection on rollback action
    Alta · 8.0 CVE-2024-21648 >= 1.0, < 14.10.17 14.10.17
  14. XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
    Alta · 8.8 CVE-2023-46243 >= 15.0, < 15.2-rc-1, >= 1.0, < 14.10.6 15.2-rc-1, 14.10.6
  15. XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
    Crítica · 9.6 CVE-2023-46242 >= 1.0, < 14.10.7, >= 15.0, < 15.2-rc-1 14.10.7, 15.2-rc-1
  16. XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
    Alta · 8.0 CVE-2023-40572 >= 3.2-milestone-3, < 14.10.9, >= 15.0-rc-1, < 15.4-rc-1 14.10.9, 15.4-rc-1
  17. Upgrading doesn't prevent exploiting vulnerable XWiki documents
    Crítica · 9.9 CVE-2023-36468 >= 2.0, < 14.10.7, >= 15.0-rc-1, < 15.2-rc-1 14.10.7, 15.2-rc-1
  18. XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
    Alta · 8.4 CVE-2023-35157 >= 3.2-milestone-3, < 14.10.6, >= 15.0-rc-0, < 15.1-rc-1 14.10.6, 15.1-rc-1
  19. XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
    Crítica · 9.9 CVE-2023-29526 >= 10.11.1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.3 13.10.11, 14.4.8, 14.10.3
  20. XWiki Platform vulnerable to code injection in display method used in user profiles
    Crítica · 9.9 CVE-2023-29523 >= 3.3-milestone-1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.2 13.10.11, 14.4.8, 14.10.2
  21. org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
    Crítica · 9.1 CVE-2023-29507 >= 14.5, < 14.10, >= 14.4.1, < 14.4.7 14.10, 14.4.7
  22. org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents
    Alta · 7.5 CVE-2023-29208 >= 1.2-milestone-1, < 13.10.11, >= 14.0-rc-1, < 14.4.7, >= 14.5, < 14.10 13.10.11, 14.4.7, 14.10
  23. XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
    Crítica · 9.9 CVE-2023-26474 >= 13.10, < 13.10.11, >= 14.0, < 14.4.7, >= 14.5, < 14.10 13.10.11, 14.4.7, 14.10
  24. Creation of new database tables through login form on PostgreSQL
    Alta · 7.5 CVE-2022-41932 < 13.10.8, >= 14.0.0, < 14.4.2, >= 14.5.0, < 14.6-rc-1 13.10.8, 14.4.2, 14.6-rc-1
  25. XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups
    Alta · 8.1 CVE-2022-31166 >= 11.3.7, < 13.10.4, >= 14.0-rc-1, < 14.2-rc-1 13.10.4, 14.2-rc-1
  26. XWiki Platform Improper Authorization check for inactive users
    Alta · 8.1 CVE-2022-36090 >= 1.1, < 13.10.5, >= 14.0, < 14.3-rc-1 13.10.5, 14.3-rc-1
  27. XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
    Alta · 7.5 CVE-2022-36092 < 13.10.4, >= 14.0, < 14.2 13.10.4, 14.2
  28. XSS Cross Site Scripting
    Crítica · 9.6 CVE-2021-29459 < 12.6.3, >= 12.6.4, < 12.8 12.6.3, 12.8
  29. RCE in XWiki
    Alta · 8.5 CVE-2020-15252 < 11.10.6, >= 12.0, < 12.5 11.10.6, 12.5

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.