{"id":"CVE-2023-30537","summary":"org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the styles properties `FlamingoThemesCode.WebHome`. This page is installed by default. The vulnerability has been patched in XWiki versions 13.10.11, 14.4.7 and 14.10.","aliases":["GHSA-vrr8-fp7c-7qgp"],"modified":"2026-08-12T13:32:35.778961Z","published":"2023-04-16T07:06:43.764Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-95"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30537.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20280"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30537.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vrr8-fp7c-7qgp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30537"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/df596f15368342236f8899ca122af8f3df0fe2e8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"4f33e1efd74016fa9eb31b3c2fcd01bc6becd551"},{"fixed":"8d72461ba6976af6005e2df511bdeeeb17ef2d74"},{"introduced":"491547c4f74b9be58123ef22081ae7e6840a11c7"},{"fixed":"5d5ba1ade22d91d0fd6bf3dd20bb96fa64264a97"},{"introduced":"bae1e23e73cafc007e5f28b39a04bfa0acf0199c"},{"fixed":"719ede2f8510fa69498761659de8d65eec5817db"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"12.6.6"},{"fixed":"13.10.11"},{"introduced":"14.0"},{"fixed":"14.4.7"},{"introduced":"14.5"},{"fixed":"14.10"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"89adfffda9d65893222b1cdf9a662664a4e75255"},{"fixed":"08e0887f0362b21614e6bfcb5be7e1f568659c41"},{"introduced":"d971304b0e0bf4f6dad278de89518edc17459741"},{"fixed":"962ee4ac0352ab1a89cc779c29e81b0674d0203e"},{"introduced":"ab4dfeaeef13360eebcaa507bc652073aa89a427"},{"fixed":"c524887d154ff8f6df9651e36b904e234bf5a6ef"},{"fixed":"df596f15368342236f8899ca122af8f3df0fe2e8"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"12.6.6"},{"fixed":"13.10.11"},{"introduced":"14.0"},{"fixed":"14.4.7"},{"introduced":"14.5"},{"fixed":"14.10"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30537.json","vanir_signatures_modified":"2026-08-12T13:32:35Z","vanir_signatures":[{"target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/test/java/org/xwiki/flamingo/WebHomeSheetPageTest.java","function":"createAction"},"deprecated":false,"digest":{"function_hash":"86225228035518904600501182968102186138","length":471},"id":"CVE-2023-30537-621cbf19","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/df596f15368342236f8899ca122af8f3df0fe2e8"},{"deprecated":false,"digest":{"line_hashes":["196624168229385537800488143190864819850","326620145150969901356163006801159818767","229987841643985390771079176931505550452","106899443067906732244318483803898197501","854129777721335591549279553009340268","172980013840435019958256218103531609371","80604558678323248162526562166156879940","320032203666808873830348614081464456763","53282654027817941439289342079189120807","56198995324426085046184762896577396819","240834788299281837403659413636619877514","232942469494076710999624885035121194002","217836278638862998896722964737627880299","47991757615719846091117688428049954252","296819425780026146382306677034487145991","151524637439872320810199560278574891816","247907957608590407773011375818339696775","95369877309169867106828166862110075782","95925972458732669052429918536570593186","159916638169907434674148752833636695504","11524350151740046428699402010431926919","325664047838866507407361139003507791927","170535140016710764409790307171476658830","145720286590753788400100957427830177661","105216750822345303069667561990377829236","286984329070727826756269686366666817121","27418491553886119427013710715050009225","23067130138629152639590986616994979616","313050027063204247106280645138462206410","317631739896172673307628465989614371027","325064074146219561956153390821186138236","330282289384805047921660475204989601012"],"threshold":0.9},"id":"CVE-2023-30537-d4c42fb3","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/df596f15368342236f8899ca122af8f3df0fe2e8","target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/test/java/org/xwiki/flamingo/WebHomeSheetPageTest.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L"}]}