XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and `org.xwiki.platform:xwiki-rendering-macro-footnotes` and prior to version 15.1-rc-1 of `org.xwiki.platform:xwiki-rendering-macro-footnotes`, the footnote macro executed its content in a potentially different context than the one in which it was defined. In particular in combination with the include macro, this allows privilege escalation from a simple user account in XWiki to programming rights and thus remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.6 and 15.1-rc-1. There is no workaround apart from upgrading to a fixed version of the footnote macro.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XWiki | xwiki-rendering | before 14.10.6; 15.0-rc-1 to before 15.1-rc-1 | 14.10.6, 15.1-rc-1 | Patch available | CNA |
| — | org.xwiki.rendering:xwiki-rendering-macro-footnotes (Maven) | before 14.10.6 | 14.10.6 | Patch available | GHSA-35j5-m29r-xfq5 |
| — | org.xwiki.rendering:xwiki-rendering-macro-footnotes (Maven) | 15.0-rc-1 to before 15.1-rc-1 | 15.1-rc-1 | Patch available | GHSA-35j5-m29r-xfq5 |
| — | org.xwiki.platform:xwiki-core-rendering-macro-footnotes (Maven) | before 14.10.6 | 14.10.6 | Patch available | GHSA-35j5-m29r-xfq5 |
- xwiki-rendering VendorXWiki Affected before 14.10.6; 15.0-rc-1 to before 15.1-rc-1 Fixed in 14.10.6, 15.1-rc-1 Patch available CNA
- org.xwiki.rendering:xwiki-rendering-macro-footnotes (Maven) Vendor— Affected before 14.10.6 Fixed in 14.10.6 Patch available GHSA-35j5-m29r-xfq5
- org.xwiki.rendering:xwiki-rendering-macro-footnotes (Maven) Vendor— Affected 15.0-rc-1 to before 15.1-rc-1 Fixed in 15.1-rc-1 Patch available GHSA-35j5-m29r-xfq5
- org.xwiki.platform:xwiki-core-rendering-macro-footnotes (Maven) Vendor— Affected before 14.10.6 Fixed in 14.10.6 Patch available GHSA-35j5-m29r-xfq5
Remediation
- Fix · CNA xwiki-rendering (xwiki) Fixed in 14.10.6, 15.1-rc-1
- Fix · GHSA-35j5-m29r-xfq5 org.xwiki.rendering:xwiki-rendering-macro-footnotes (Maven) Fixed in 14.10.6 Advisory →
- Fix · GHSA-35j5-m29r-xfq5 org.xwiki.rendering:xwiki-rendering-macro-footnotes (Maven) Fixed in 15.1-rc-1 Advisory →
- Fix · GHSA-35j5-m29r-xfq5 org.xwiki.platform:xwiki-core-rendering-macro-footnotes (Maven) Fixed in 14.10.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-37912
- 2026-10-03 Alias added: GHSA-35j5-m29r-xfq5
References
Patch 2
More Xwiki-rendering vulnerabilities
- TI-2023-19341 Cross-site scripting in xwiki-rendering CVSS 3.1CRITICAL 9.6
- TI-2025-40901 XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection CVSS 4.0HIGH 8.7
- TI-2026-19446 XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages CVSS 4.0MEDIUM 6.5
Sources
- CVE-2023-37912 · CVE Program
- CVE-2023-37912 · NVD
- FIRST EPSS
- GHSA-35j5-m29r-xfq5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences