{"id":"CVE-2023-37914","summary":"Privilege escalation (PR)/RCE from account through Invitation subject/message","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.WebHome` can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6. Users are advised to upgrade. Users unable to upgrade may manually apply the patch on `Invitation.InvitationCommon` and `Invitation.InvitationConfig`, but there are otherwise no known workarounds for this vulnerability.","aliases":["GHSA-7954-6m9q-gpvf"],"modified":"2026-08-12T14:50:53.864147Z","published":"2023-08-17T17:21:23.571Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37914.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20421"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37914.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7954-6m9q-gpvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37914"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"48ee3193230753aecf8a86d7c8ff3e8f869e8330"},{"fixed":"f0645cf53274e7ef6c17285a079673573c4e41c2"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"16d8434e51afd80d6f06568c8449eb0c9fbfdb40"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.5"},{"fixed":"14.4.8"},{"introduced":"14.5.0"},{"fixed":"14.10.6"},{"introduced":"15.0"},{"fixed":"15.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"62837a8157743695d6115009f41bd59ef099ea23"},{"fixed":"b469b950e7fe3d22f00b639d43f286bf871472b1"},{"introduced":"0"},{"fixed":"db1b7950037774552be2897571c2e1c5a7589400"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"7d8a0fa4bef8e285a5aa1e65d78d05e10f3800ab"},{"fixed":"ff1d8a1790c6ee534c6a4478360a06efeb2d3591"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.5"},{"fixed":"14.4.8"},{"introduced":"14.5.0"},{"fixed":"14.10.6"},{"introduced":"15.0"},{"fixed":"15.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-15.2-rc-1","xwiki-commons-14.10.5","xwiki-commons-14.10.4","xwiki-commons-14.10.3","xwiki-commons-14.10.2","xwiki-commons-14.10.1","xwiki-commons-14.10","xwiki-commons-14.4.7","xwiki-commons-14.4.6","xwiki-commons-14.4.5","xwiki-commons-14.4.4","xwiki-commons-14.4.3","xwiki-commons-14.4.2","xwiki-commons-14.4.1","xwiki-commons-14.4","xwiki-commons-14.4-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-15.2-rc-1","xwiki-platform-14.10.5","xwiki-platform-14.10.4","xwiki-platform-14.10.3","xwiki-platform-14.10.2","xwiki-platform-14.10.1","xwiki-platform-14.10","xwiki-platform-14.4.7","xwiki-platform-14.4.6","xwiki-platform-14.4.5","xwiki-platform-14.4.4","xwiki-platform-14.4.3","xwiki-platform-14.4.2","xwiki-platform-14.4.1","xwiki-platform-14.4","xwiki-platform-14.4-rc-1","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37914.json","vanir_signatures_modified":"2026-08-12T14:50:53Z","vanir_signatures":[{"digest":{"function_hash":"339282825351180123961268690316147546200","length":1550},"id":"CVE-2023-37914-27621e5e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591","target":{"file":"xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/test/java/org/xwiki/invitation/InvitationCommonPageTest.java","function":"testEq1ConfigClassExistsNewInvitationConfig"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591","target":{"file":"xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/test/java/org/xwiki/invitation/InvitationCommonPageTest.java","function":"testEq1ConfigClassExistsConfigMapTooSmall"},"deprecated":false,"digest":{"length":1416,"function_hash":"67262820242911171743754105937048326518"},"id":"CVE-2023-37914-3dc25c65","signature_type":"Function"},{"target":{"file":"xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/test/java/org/xwiki/invitation/InvitationConfigPageTest.java","function":"escapeInfoMessageInternalDocumentParameter"},"deprecated":false,"digest":{"function_hash":"71863537301444799077272327351964966371","length":442},"id":"CVE-2023-37914-42455d99","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591"},{"target":{"file":"xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/test/java/org/xwiki/invitation/InvitationCommonPageTest.java","function":"testEq1ConfigClassExistsInvalidFromAddress"},"deprecated":false,"digest":{"function_hash":"235862181908831211954227013046329049174","length":1529},"id":"CVE-2023-37914-44b99789","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591"},{"id":"CVE-2023-37914-4d9afd1d","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591","target":{"file":"xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/test/java/org/xwiki/invitation/InvitationCommonPageTest.java"},"deprecated":false,"digest":{"line_hashes":["333090352389187170801825376565132473786","116412206127966436128767184033753837360","263448177281553707790028158109487388756","20778338281122017743125412566687563986","105666250373144419032357085645317720632","162251258662267141777424005441306742748","268773732375373482535109211690093702716","29956268411415547975701237935062678505","212423808098395960562622633257466090516","175484378710074101183245831106544000525","252122563298327165699246934730577956087","250544293623661809530317766171102103957","186385996053887794477137311729211064477","290872835019689251874476707551412991752","172406792903650741470166673000903369152","277110893706752377705324568784460023704","305596593979266117398086650852498063363","12506563777896120562445885728241976150","337786582398331095230695674895112077478","148082600552280786734410900754358420375","4594934105779342876769071329624673948","155814237569296886786549447327829669754","130871420701499853483186221505134882858","318228723242573276336330888718138070746","37226958206649956883424515157654676926","55163362005656742650560605480119899941","125961294230185329869282929815872633795","153242436695507217457050113470762617261","303581578229287462211123690587912806133","16534969778308144015932844935907707296","145832155068524320595031433869164059345","291610701768203846470447401116504402346","77812901762574834515799755941418389296","334899099289131166628057856792193979063","258079907243326367073660539897976641695","145832155068524320595031433869164059345","291610701768203846470447401116504402346","77812901762574834515799755941418389296","334899099289131166628057856792193979063","336556536999853337948998530681039411670","41979993815744568304782095253070059343","111514281388493603355440369531433507053","88216652890450733044962090205411058465","206673131740715486075935294483096812933","256524209756057872763166515055663012547","94859041154442447525023319297993774877","316035241805452196524024309367529002212","78123573111685296579732394564562255894","300400248462360277531792962464781831910"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"110075238731715126816926482170607395828","length":900},"id":"CVE-2023-37914-4d9fc8b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591","target":{"file":"xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/test/java/org/xwiki/invitation/InvitationCommonPageTest.java","function":"displayMessageVelocityMacro"}},{"deprecated":false,"digest":{"function_hash":"320583521172056956845216382720741424680","length":1002},"id":"CVE-2023-37914-af0c24a0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591","target":{"file":"xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/test/java/org/xwiki/invitation/InvitationCommonPageTest.java","function":"testEq1ConfigClassIsNew"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591","target":{"file":"xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/test/java/org/xwiki/invitation/InvitationCommonPageTest.java","function":"testEq0"},"deprecated":false,"digest":{"function_hash":"94229145256540923301982839580488994152","length":461},"id":"CVE-2023-37914-b5d0f79c","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["45828237684934314065673435622360057394","152917747732704500406673668331957836175","70927632413549507712131618842966499298","296819425780026146382306677034487145991","213667004644762520258648145509200480803","120087305962682635948618086036633016784","305562815700333167243307812852697316714","332488330178457715968730560669877093206","49539193550979267086726052304514938522","18841764902700320163553247793842569027","117307399422290762277147793410764519658","33890990930764568279657006834728419859","261334841522569931985973519625921742446","92347541357779961345317384096426137084","155700986957335332932765934378344430213"],"threshold":0.9},"id":"CVE-2023-37914-de0be649","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591","target":{"file":"xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/test/java/org/xwiki/invitation/InvitationConfigPageTest.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L"}]}