{"id":"CVE-2023-29510","summary":"Code injection via unescaped translations in xwiki-platform","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged contexts without any escaping which allows remote code execution for any user who has edit access on at least one document which could be the user's own profile where edit access is enabled by default. A mitigation for this vulnerability is part of XWiki 14.10.2 and XWiki 15.0 RC1: translations with user scope now require script right. This means that regular users cannot exploit this anymore as users don't have script right by default anymore starting with XWiki 14.10. There are no known workarounds apart from upgrading to a patched versions.","aliases":["GHSA-4v38-964c-xjmw"],"modified":"2026-09-10T09:42:42.764504Z","published":"2023-04-18T23:42:44.396Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-74"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29510.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19749"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29510.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4v38-964c-xjmw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29510"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"510f15e9cf478e71a9cb4ad0d0dbfb64e40cffe4"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"14.10.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"fixed":"304f1c5906fe7ad6256b0792290ef89592c1f3b7"},{"fixed":"d06ff8a58480abc7f63eb1d4b8b366024d990643"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"14.10.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-14.10.1","xwiki-commons-14.10","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-14.10.1","xwiki-platform-14.10","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"vanir_signatures_modified":"2026-09-10T09:42:42Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["50073568028353366611273221755401745653","134480294942220261015210170254277242894","331510766127343420789968739366721030503","281788940964498940176504628581840122682","65512152234873831033684814403114998170","56467388480151104790311926893010625789","309993144554622885878824906487141600513","7384320968059948735266816309241433038","145972478562908613451476352751491016459","171163947610648874119153990781432780498","299290034472767353089146375813051122029","190392967422984538467286159571320916160","117277954670820814866843944457153626766","55009021832839936123964131756371216008","337133515792156341414706980642182119011","260937451834192002621660045913900307285","165419812025615114495587492563725133780","295290396471270350152938226147773288276","282495750716133444232835450172276941447","64220327377566544352286482351808892626","222519317610830869816988276715187115792","22026708057941742361029474601856428895","205269015617616950103766163883056134700","21736468172291447031381574306187139962","209381480174501343170920337488831239256","160173173918975405889321478030168188031","42048786006572054439763730405122979786","202105078486516164739489199361167146527","201782633080878065799094111550770554592","78046912815210804857188556122305121574","188158718551583006809093976473709392392","157498722809309121342524776743215135155","245436775060327114957428535341506275808","147660182155036919287132190384379622687","247489025496334748624448525087487711360","88397010774710106314183366910116371629","208314963703068029675191934001152876766","337193918181431826351969872381552912001","70411341178904775478202105689297385211","123116258515351455184357598657727524302","208083568291291384887713733686155570868","48132598744446424174355213305668772223","273519456801444452761610047061241317695","224398776486941082844923747932442351342","186137195179598991393668648457027137935","159256021392441383193939762097185281232","203339591262068418506151830937591808408","240632580548441078232909778179113273172","170372666904158881024833431547795639034","49297999090671613258410509214998036814","337582766887561896061293725531436991660","106538887069983871599490589778828533996","33887496162029397139511153354817349002","61869785104970506777147599730275428553","307803244243642088311043727755692680358","106384977683484464106481647393738477134","60878491438243383147823078284691276652","255405771218405844867041947381865720782","286335603422582840741829345678711737580","185065285853378661781931572991100862962","211920408590195996628696700500068495855","110025094941371015137144145126178899855","177378724810920391061494450651743554690","148712626484031208039115128441986769760","163908632968864849563572264401343776039","176434141244973115476708229180665800048","189098384938667899620743127538795081235","31057200443869155893345071229780539043","153143205708306371729399699205170497144","314926516161492383057080090763816401038","155350746003509450693474160816495197297","3461258802108336586353867477778946446","210620669577987160808309061490225095112","22423503326028908940622414043324358027","304587759723969800396112911643184541570","152518549750121526622907686947724039625","33355961353793955039547015344294202994","53755188152525426973066548178608698611","302431186398110268838728874616236497931","313758163230532146098976218915383736861","203084688348416767337525838094695269140","165910288602842814891716659999505541345","16678884686454502844987546034726233394","76766816642610134667680942653124712691","199451764864502965658186066326844768841","239361969918796079362018583132387988950","132762257349611042912840793294532845414","7504010288794084747143497275098703186","70584031570115243063087788573920370289","337790136398616333345741563192008868833","148759655026875892326400100144012617222","187360305566344182191141844494315837846","86677414839354511234682733084774426366","330991810683560893167164458947233545677","338524005726342137599487356665601699142","312732524286467173255815664177335189728","69487908000864560246429414514724449090","235447529732245471070927924189442954591","158274589442681017365296762894914484329","322203232478375997255957597396450224319","95790730068939374304806848146800683879"],"threshold":0.9},"id":"CVE-2023-29510-7464e501","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643","target":{"file":"xwiki-platform-core/xwiki-platform-localization/xwiki-platform-localization-sources/xwiki-platform-localization-source-wiki/src/test/java/org/xwiki/localization/wiki/internal/DocumentTranslationBundleFactoryTest.java"}},{"id":"CVE-2023-29510-7ed86508","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643","target":{"file":"xwiki-platform-core/xwiki-platform-localization/xwiki-platform-localization-sources/xwiki-platform-localization-source-wiki/src/test/java/org/xwiki/localization/wiki/internal/DocumentTranslationBundleFactoryTest.java","function":"before"},"deprecated":false,"digest":{"function_hash":"51510827253928610411132149211381057012","length":1132}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643","target":{"file":"xwiki-platform-core/xwiki-platform-localization/xwiki-platform-localization-sources/xwiki-platform-localization-source-wiki/src/main/java/org/xwiki/localization/wiki/internal/DocumentTranslationBundleFactory.java","function":"checkRegistrationAuthorization"},"deprecated":false,"digest":{"function_hash":"123885310909251718103161775986058311198","length":369},"id":"CVE-2023-29510-980f97da"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643","target":{"file":"xwiki-platform-core/xwiki-platform-localization/xwiki-platform-localization-sources/xwiki-platform-localization-source-wiki/src/test/java/org/xwiki/localization/wiki/internal/DocumentTranslationBundleFactoryTest.java","function":"registerComponents"},"deprecated":false,"digest":{"length":222,"function_hash":"168956148116568616111254527941893565939"},"id":"CVE-2023-29510-a21f0e9b","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643","target":{"file":"xwiki-platform-core/xwiki-platform-localization/xwiki-platform-localization-sources/xwiki-platform-localization-source-wiki/src/test/java/org/xwiki/localization/wiki/internal/DocumentTranslationBundleFactoryTest.java","function":"DocumentTranslationBundleFactoryTest"},"deprecated":false,"digest":{"function_hash":"147584502516364827525168332875828036852","length":127},"id":"CVE-2023-29510-a5926e4b"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643","target":{"file":"xwiki-platform-core/xwiki-platform-localization/xwiki-platform-localization-sources/xwiki-platform-localization-source-wiki/src/test/java/org/xwiki/localization/wiki/internal/DocumentTranslationBundleFactoryTest.java","function":"assertTranslation"},"deprecated":false,"digest":{"function_hash":"55039624302572777717118817620529789826","length":324},"id":"CVE-2023-29510-ab68c741","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["50701756362231942887163513460346088925","256526798917634396234194399548317968619","68829906089837401459814486316813020048","133957906935660582285076820129467902055","31646351880135884032340594183414455966","260765168921805558395676097635494527061","273044645211350846033584871890401335473"],"threshold":0.9},"id":"CVE-2023-29510-adc04efe","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643","target":{"file":"xwiki-platform-core/xwiki-platform-localization/xwiki-platform-localization-sources/xwiki-platform-localization-source-wiki/src/main/java/org/xwiki/localization/wiki/internal/DocumentTranslationBundleFactory.java"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-localization/xwiki-platform-localization-sources/xwiki-platform-localization-source-wiki/src/test/java/org/xwiki/localization/wiki/internal/DocumentTranslationBundleFactoryTest.java","function":"addTranslation"},"deprecated":false,"digest":{"function_hash":"89670502558257926005779265498275279007","length":1293},"id":"CVE-2023-29510-ec443fb3","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-29510.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}