Read the docs
TI-2023-27667 Aliases CVE-2023-50721GHSA-7654-vfh6-rw6x

XWiki Platform RCE from account through SearchAdmin

Priority HIGH 83CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros including Groovy macros that allow remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki instance. This attack can be executed by any user who can edit some wiki page like the user's profile (editable by default) as user interface extensions that will be displayed in the search administration can be added on any document by any user. The necessary escaping has been added in XWiki 14.10.15, 15.5.2 and 15.7RC1. As a workaround, the patch can be applied manually applied to the page `XWiki.SearchAdmin`.

Why it matters now

EPSS 0.78812 99th percentileScored 2026-11-07
Fix Fixed xwiki-platform (xwiki): 14.10.15, 15.5.2, 15.7-rc-1org.xwiki.platform:xwiki-platform-search-ui (Maven): 14.10.15, 15.5.2, 15.7-rc-1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-platform4.5-rc-1 to before 14.10.15; 15.0-rc-1 to before 15.5.2; 15.6-rc-1 to before 15.7-rc-114.10.15, 15.5.2, 15.7-rc-1Patch availableCNA
—org.xwiki.platform:xwiki-platform-search-ui (Maven)4.5-rc-1 to before 14.10.1514.10.15Patch availableGHSA-7654-vfh6-rw6x
—org.xwiki.platform:xwiki-platform-search-ui (Maven)15.0-rc-1 to before 15.5.215.5.2Patch availableGHSA-7654-vfh6-rw6x
—org.xwiki.platform:xwiki-platform-search-ui (Maven)15.6-rc-1 to before 15.7-rc-115.7-rc-1Patch availableGHSA-7654-vfh6-rw6x
  • xwiki-platform VendorXWiki Affected 4.5-rc-1 to before 14.10.15; 15.0-rc-1 to before 15.5.2; 15.6-rc-1 to before 15.7-rc-1 Fixed in 14.10.15, 15.5.2, 15.7-rc-1 Patch available CNA
  • org.xwiki.platform:xwiki-platform-search-ui (Maven) Vendor— Affected 4.5-rc-1 to before 14.10.15 Fixed in 14.10.15 Patch available GHSA-7654-vfh6-rw6x
  • org.xwiki.platform:xwiki-platform-search-ui (Maven) Vendor— Affected 15.0-rc-1 to before 15.5.2 Fixed in 15.5.2 Patch available GHSA-7654-vfh6-rw6x
  • org.xwiki.platform:xwiki-platform-search-ui (Maven) Vendor— Affected 15.6-rc-1 to before 15.7-rc-1 Fixed in 15.7-rc-1 Patch available GHSA-7654-vfh6-rw6x

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*4.5 to before 14.10.5; 15.0 to before 15.5.2VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:15.6:-:*:*:*:*:*:*15.6VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:15.6:rc1:*:*:*:*:*:*15.6 rc1VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:15.7:rc1:*:*:*:*:*:*15.7 rc1VulnerableXWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions 4.5 to before 14.10.5; 15.0 to before 15.5.2 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:15.6:-:*:*:*:*:*:* Versions 15.6 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:15.6:rc1:*:*:*:*:*:* Versions 15.6 rc1 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:15.7:rc1:*:*:*:*:*:* Versions 15.7 rc1 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-platform (xwiki) Fixed in 14.10.15, 15.5.2, 15.7-rc-1
  • Fix · GHSA-7654-vfh6-rw6x org.xwiki.platform:xwiki-platform-search-ui (Maven) Fixed in 14.10.15 Advisory →
  • Fix · GHSA-7654-vfh6-rw6x org.xwiki.platform:xwiki-platform-search-ui (Maven) Fixed in 15.5.2 Advisory →
  • Fix · GHSA-7654-vfh6-rw6x org.xwiki.platform:xwiki-platform-search-ui (Maven) Fixed in 15.7-rc-1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50721
  2. 2026-10-03 Alias added: GHSA-7654-vfh6-rw6x

References

Patch 3

Advisory 1

Other 1

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences