CVE-2023-50732 : Vulnerability Insights and Analysis

This CVE record involves a Velocity execution vulnerability in XWiki-platform that allows execution without script right through a tree macro.

Understanding CVE-2023-50732

This vulnerability is assigned a CVSS base score of 8.3, indicating a High severity level due to incorrect authorization.

What is CVE-2023-50732?

The XWiki Platform, a generic wiki platform, allows the execution of a Velocity script without the required script right through the document tree. This issue has been addressed in versions XWiki 14.10.7 and 15.2RC1.

The Impact of CVE-2023-50732

The vulnerability poses a threat of unauthorized script execution and can potentially lead to data confidentiality, integrity, and availability risks within affected systems.

Technical Details of CVE-2023-50732

The vulnerability CVE-2023-50732 identified with CWE-863 (Incorrect Authorization) has the following technical details:

CVSS Base Score: 8.3 (High)
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: Low
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Vulnerability Description

The vulnerability allows the execution of Velocity scripts without the necessary script right permissions through the document tree in XWiki Platform.

Affected Systems and Versions

Vendor: XWiki
Product: XWiki-platform
Affected Versions:
= 8.3-rc-1, < 14.10.7

= 15.0-rc-1, < 15.2-rc-1

Exploitation Mechanism

The exact exploitation mechanism of this vulnerability is unknown.

Mitigation and Prevention

To mitigate the risks associated with CVE-2023-50732, follow these practices:

Immediate Steps to Take

Update affected XWiki-platform instances to versions 14.10.7 or 15.2RC1.
Monitor for any unauthorized script executions on the platform.

Long-Term Security Practices

Regularly update and patch XWiki-platform to the latest versions to ensure security patches are applied.
Implement strict access controls and permissions management to prevent unauthorized script executions.

Patching and Updates

Refer to the provided references for patching information and updates on XWiki-platform security:

XWiki-platform Security Advisory
XWiki-platform Commit Details
XWiki JIRA Issue Tracker