{"id":"CVE-2023-46243","summary":"Code execution via the edit action in XWiki platform","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execute any content with the right of an existing document's content author, provided the user have edit right on it. A crafted URL of the form ` /xwiki/bin/edit//?content=%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+Groovy%21%22%29%7B%7B%2Fgroovy%7D%7D&xpage=view` can be used to execute arbitrary groovy code on the server. This vulnerability has been patched in XWiki versions 14.10.6 and 15.2RC1. Users are advised to update. There are no known workarounds for this issue. ","aliases":["GHSA-g2qq-c5j9-5w5w"],"modified":"2026-08-12T14:51:20.462912Z","published":"2023-11-07T19:10:45.565Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46243.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20385"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46243.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g2qq-c5j9-5w5w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46243"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/a0e6ca083b36be6f183b9af33ae735c1e02010f4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"f0645cf53274e7ef6c17285a079673573c4e41c2"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"16d8434e51afd80d6f06568c8449eb0c9fbfdb40"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0"},{"fixed":"14.10.6"},{"introduced":"15.0"},{"fixed":"15.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"93d8322eda7b68fd66f33334b982b047d7cf4f36"},{"fixed":"db1b7950037774552be2897571c2e1c5a7589400"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"7d8a0fa4bef8e285a5aa1e65d78d05e10f3800ab"},{"fixed":"a0e6ca083b36be6f183b9af33ae735c1e02010f4"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0"},{"fixed":"14.10.6"},{"introduced":"15.0"},{"fixed":"15.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-15.2-rc-1","xwiki-commons-14.10.5","xwiki-commons-14.10.4","xwiki-commons-14.10.3","xwiki-commons-14.10.2","xwiki-commons-14.10.1","xwiki-commons-14.10","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["268624534721901109969900642748275712521","133289433129283155613746193931430573168","190271921785631462074484121442604053280","334531484778381525864792345094806263770","52210527608095429596442788358919915035","69270545061116924550623810227972116945","255140068624808091632439859628132218359","40573890050491915028769517106658745157","279189869676948373092617295141007803000","283032416927595898806855552993324268741","135714860326707922361461750615349322065","282045045134134502652805197239963506401"],"threshold":0.9},"id":"CVE-2023-46243-48dddc53","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a0e6ca083b36be6f183b9af33ae735c1e02010f4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/EditAction.java"}},{"deprecated":false,"digest":{"function_hash":"170406624868041942944792266794481278973","length":1564},"id":"CVE-2023-46243-78bb9f32","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a0e6ca083b36be6f183b9af33ae735c1e02010f4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/MockitoOldcore.java","function":"answer"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a0e6ca083b36be6f183b9af33ae735c1e02010f4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/MockitoOldcore.java","function":"before"},"deprecated":false,"digest":{"function_hash":"88122748487390756376596092170406887215","length":25103},"id":"CVE-2023-46243-8bcce7aa"},{"deprecated":false,"digest":{"length":463,"function_hash":"38667149592537803094320518475051064138"},"id":"CVE-2023-46243-b7524382","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a0e6ca083b36be6f183b9af33ae735c1e02010f4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/EditAction.java","function":"prepareEditedDocument"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a0e6ca083b36be6f183b9af33ae735c1e02010f4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/MockitoOldcore.java"},"deprecated":false,"digest":{"line_hashes":["59257926857016635813350339933765225281","192863570880510464653364606256025176971","252248817219372894513939888648547342415","216139293873584720238343390399928845052","89256694976533841581932554250314575114","90228170043478801447926734682954482680","300855592336296384050164182376921418576","243378372621294938127926078230193972568","46285160250269417247033664821436464040","215823643227703219599443676022369521153","212608794415177139561958939951685855541"],"threshold":0.9},"id":"CVE-2023-46243-e0beb812","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46243.json","vanir_signatures_modified":"2026-08-12T14:51:20Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}