{"id":"CVE-2023-40573","summary":"XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki. If the attack is successful, an error log entry with \"Job content executed\" will be produced. This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.","aliases":["GHSA-8xhr-x3v8-rghj"],"modified":"2026-08-12T13:32:41.022448Z","published":"2023-08-24T01:31:14.128Z","database_specific":{"cwe_ids":["CWE-284"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40573.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20852"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40573.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8xhr-x3v8-rghj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40573"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"3b0ff213f269a234333b177bfff6d8f227be8256"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"last_affected":"68863e636fb48bcfc933880f81779d7dd17a06b8"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.1:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.2:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.3:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"14.10.9"},{"introduced":"15.0-NA"},{"last_affected":"15.0-NA"},{"introduced":"15.1-NA"},{"last_affected":"15.1-NA"},{"introduced":"15.2-NA"},{"last_affected":"15.2-NA"},{"introduced":"15.3-NA"},{"last_affected":"15.3-NA"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"fixed":"1b0b53998b15e408df8e3dafd8845896d8d4c50e"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.1:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.2:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.3:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"14.10.9"},{"introduced":"15.0-NA"},{"last_affected":"15.0-NA"},{"introduced":"15.1-NA"},{"last_affected":"15.1-NA"},{"introduced":"15.2-NA"},{"last_affected":"15.2-NA"},{"introduced":"15.3-NA"},{"last_affected":"15.3-NA"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["15.0-NA","15.1-NA","15.2-NA","15.3-NA","\u003e= 1.3","xwiki-commons-15.3","xwiki-commons-15.3-rc-1","xwiki-commons-14.10.8","xwiki-commons-14.10.7","xwiki-commons-14.10.6","xwiki-commons-14.10.5","xwiki-commons-14.10.4","xwiki-commons-14.10.3","xwiki-commons-14.10.2","xwiki-commons-14.10.1","xwiki-commons-14.10","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-14.10.8","xwiki-platform-14.10.7","xwiki-platform-14.10.6","xwiki-platform-14.10.5","xwiki-platform-14.10.4","xwiki-platform-14.10.3","xwiki-platform-14.10.2","xwiki-platform-14.10.1","xwiki-platform-14.10","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40573.json","vanir_signatures_modified":"2026-08-12T13:32:41Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"313481270971042628761796727599621061379","length":1180},"id":"CVE-2023-40573-4f682497","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-api/src/main/java/com/xpn/xwiki/plugin/scheduler/GroovyJob.java","function":"executeJob"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-api/src/main/java/com/xpn/xwiki/plugin/scheduler/GroovyJob.java"},"deprecated":false,"digest":{"line_hashes":["49532723767442487758591324200189283744","245353265591212186309458092426065800492","244084767252433702548635213984874894779","165566834544075045525391644010337541554","74723711114655667361759069455407469559","308239956598842523855586444894151265269","35753873109773258587497578936130069420","161277240926577000041349019709746664378","190528861456869262758771626262659145777","310138481561766541516839316654475520223","166343725634506343160915679503793805817","282531453842335282133301127720566831682","159746581422373221973662022270352713143","180918363571907280890138517469010393566","288951634120136216161566039934763084370","42476783556263201988312664740020087071","55740169446061434562356102117867275492","261313764663695625154455950108194170237","92771341448717861202827932671380414303","214054902639471524381972063146722984003","277937631491321119928131758130314841895","102850910725179931362767110058290932441","68147481478115713763329103404254076992","132186322832280277666179145978674357056","267882798695658769089362010405202697920","287493131035430649905070372819516853581","193369916027503413040186019602450816190","322568628766211578075175622981314457952","44738789624405891225089933819908154966"],"threshold":0.9},"id":"CVE-2023-40573-7cad9e50"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}