{"id":"CVE-2023-37912","summary":"XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro","details":"XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and `org.xwiki.platform:xwiki-rendering-macro-footnotes` and prior to version 15.1-rc-1 of `org.xwiki.platform:xwiki-rendering-macro-footnotes`, the footnote macro executed its content in a potentially different context than the one in which it was defined. In particular in combination with the include macro, this allows privilege escalation from a simple user account in XWiki to programming rights and thus remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.6 and 15.1-rc-1. There is no workaround apart from upgrading to a fixed version of the footnote macro.","aliases":["GHSA-35j5-m29r-xfq5"],"modified":"2026-08-12T13:32:39.034157Z","published":"2023-10-25T17:33:54.756Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-270"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37912.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XRENDERING-688"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37912.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-35j5-m29r-xfq5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37912"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-rendering","events":[{"introduced":"0"},{"fixed":"351c65f14efa17fbc8dfe0277a5a66ffc3ddc4df"},{"fixed":"5f558b8fac8b716d19999225f38cb8ed0814116e"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki-rendering:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"14.10.6"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-rendering-14.10.5","xwiki-rendering-14.10.4","xwiki-rendering-14.10.3","xwiki-rendering-14.10.2","xwiki-rendering-14.10.1","xwiki-rendering-14.10","xwiki-rendering-8.3-milestone-2","xwiki-rendering-8.3-milestone-1","xwiki-rendering-8.2-milestone-2","xwiki-rendering-8.2-milestone-1","xwiki-rendering-8.1-milestone-2","xwiki-rendering-8.1-milestone-1","xwiki-rendering-8.0-milestone-2","xwiki-rendering-8.0-milestone-1","xwiki-rendering-7.4-milestone-2","xwiki-rendering-7.4-milestone-1","xwiki-rendering-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37912.json","vanir_signatures_modified":"2026-08-12T13:32:39Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"209361043058061159886879193397113744297","length":1005},"id":"CVE-2023-37912-043cc301","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e","target":{"file":"xwiki-rendering-macros/xwiki-rendering-macro-footnotes/src/main/java/org/xwiki/rendering/internal/macro/footnote/PutFootnotesMacro.java","function":"execute"}},{"deprecated":false,"digest":{"line_hashes":["239924222722073376130282249318515310512","125588726747505565651201600297297510283","195417830288742120400626422911997146011","25456195849317191248323009999830748451","328251497452063070928822417358201651019","162237061877156176567059265106135918985","62984473060872022523611004993793890832","851825561320450648610364986265514206","175997574198847582250209457839881463693","204742266282927796631954528756891917132","5355812389878397165387883842467043800","141413657383399134960855728914532607116","221335781885422249524806075443544788362"],"threshold":0.9},"id":"CVE-2023-37912-08690477","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e","target":{"file":"xwiki-rendering-macros/xwiki-rendering-macro-footnotes/src/main/java/org/xwiki/rendering/internal/macro/footnote/FootnoteMacro.java"}},{"deprecated":false,"digest":{"function_hash":"108084058853482046843320687508092034424","length":354},"id":"CVE-2023-37912-210b8c66","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e","target":{"file":"xwiki-rendering-macros/xwiki-rendering-macro-footnotes/src/main/java/org/xwiki/rendering/internal/macro/footnote/PutFootnotesMacro.java","function":"processFootnote"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e","target":{"file":"xwiki-rendering-macros/xwiki-rendering-macro-footnotes/src/main/java/org/xwiki/rendering/internal/macro/footnote/PutFootnotesMacro.java","function":"createFootnoteReferenceBlock"},"deprecated":false,"digest":{"length":472,"function_hash":"134921174709978393392161684447854059324"},"id":"CVE-2023-37912-67e76169"},{"id":"CVE-2023-37912-a91386eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e","target":{"file":"xwiki-rendering-macros/xwiki-rendering-macro-footnotes/src/main/java/org/xwiki/rendering/internal/macro/footnote/FootnoteMacro.java","function":"execute"},"deprecated":false,"digest":{"function_hash":"192617445690985209599082604045924153825","length":482}},{"deprecated":false,"digest":{"line_hashes":["243317210428777012809225799057531285641","329333482021716272495227119354418708456","127359169975751683852886301825652626324","103226457629222238098083422453166431465","276695545085459318448729067077208245161","99426874768089598840090126476058665019","14968965963091909863286157724714646318","45305257913488895576415572964211436468","120700078784502785817661644150989536640","126016491348461228272473314869404596240","108946414259889912711990495058324390649","312366574457972686297766417568935993721","141696767582161259765415205020202470626","12916540743775515417489758980928077488","54120545601344725059487357774523499878","8456082334493676562833459089438679772","166652086357439188598461254493405819546","157509847490541450857685524455539615974","174391424063433010224492818006721744777","34474218454874719421383853146850137571","81294980848695655170291045334731904379","320907957984770599236817096808229293852","60573377713453148746970206766443219510","331614345245087704791682088650471503502","282917758059881125550705759718526762889","294231053299460452072640360350354478371","267809044376280082944536002532912867149","264546874046063194181431021955198070803","157043167085422655114951330366972757522","126540171143027545961518949066683983095","29763948537412318861253263768987136736","233134093708320828445658086824162729508","245691169523022080166564656625690577277","112799344206627779020936406924356567347","318237760395248969676149136848554941387","14322193294479419488428929254181871755","246521894098187649639007789826646009326","214988467371427373137972152562525189890","232030931035830863683296809273312645586","57808721354945718054909153173503206648","135673590648615128727078659491875926401","97791117161488267052621994206447091638","306788274576667841529787708495124715870","332274612687297331898077512368465020745","244688132340432096197270705195755877600","74043891058985981952133955817605472590","170601889947413706077627649374289662209","176159948800470455637859586206390833478","168835150389254948787162919712452990771","317198322868562200824301469009577139817","10371342721107999890260374767089865562","52688892391521637138341370037041728594","190349746842840838879716935554406133240","273176425418996698068932077111799141969","40106102665990549542571013422394968219","336559342014932112157655480503767646143","300953844537689253324413254402214782383","91941376337920155766125914619169910542","40260731962035289521771643260436367276","50777901643237821353153213751573070477","152825226083354664068374254055851790786","64486465382738780660446441396707289582","22385015972232142441241359487358476592","97219593104329965409959569249052925156","20199003447380857862257544571861069694","315068770890826621607395838329327439487","193725401447221033827122087981494985579","236626907154643493547800533306367350333","19398111980680858846395147790615633756","80796731725559167304976070472348071212","176774899791775059728417962666268630592","169611678722845839752114649606603213318","25991932631801378097893736550537348176","215743168968160761995739081150115814879","89634869427161690931564528725416629822","265644336582843013965657314316800881583","46781609798584130568166363046027768424","261906926110933835994449988696881424013","130291251543576108291985131102672128517","265500149513985650475715503575114693884","33111553320463358393641771241797930064","27917558623416391332960577829856898660","51383418447146619870590496394705183477","93796899004220352994493229241308293214","297243420013293770061092975788151168826","291184377852248001697894482591254378408","125064868677544216161709419512664883779","294323151647937241468940002899992824870","162662971399649534035763573250699576721","127239496675234644129024722378440024453","79733255768022563651808073515930835118","8711955682588724305874787656851034533","314310463439821458185450758412721899163","26834481101539691680014555198472703575","99263529188107693386167207913894862560","53206897246544258617926345912553557917","156326144940428604041312526459139134883","236612453018733996572569523762887648012","122810845770940963483814073912538531268","316036443779286422093347151018688701784","69661547148769359671901018714027418530","102179149189226978720292156880981749277","91436647681327617031563522457195522946","62279096784425671971067349538601985286","180214302829805916276794835113451277319","7003932752113213490834884715771598086","281298884996953478325573915434684362524"],"threshold":0.9},"id":"CVE-2023-37912-ded9ff78","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e","target":{"file":"xwiki-rendering-macros/xwiki-rendering-macro-footnotes/src/main/java/org/xwiki/rendering/internal/macro/footnote/PutFootnotesMacro.java"}},{"digest":{"function_hash":"25797362399613899425610415488998532570","length":774},"id":"CVE-2023-37912-ee9fb406","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e","target":{"file":"xwiki-rendering-macros/xwiki-rendering-macro-footnotes/src/main/java/org/xwiki/rendering/internal/macro/footnote/PutFootnotesMacro.java","function":"createFootnoteBlock"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}