Iniciar sesión
Deutsch English Español Polski
Media

Velocity execution without script right through VelocityCode and VelocityWiki property

  • Publicada: 04.09.2023
  • Actualizado: 11.10.2026 13:20

Impact

It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the former, the syntax of the document needs to be set the xwiki/1.0 (this syntax doesn't need to be installed). In both cases, when adding the property to an object, the Velocity code is executed regardless of the rights of the author of the property (edit right is still required, though). In both cases, the code is executed with the correct context author so no privileged APIs can be accessed. However, Velocity still grants access to otherwise inaccessible data and APIs that could allow further privilege escalation.

At least for "VelocityCode", this behavior is most likely very old but only since XWiki 7.2, script right is a separate right, before that version all users were allowed to execute Velocity and thus this was expected and not a security issue.

Patches

This has been patched in XWiki 14.10.10 and 15.4 RC1.

Workarounds

There are no known workarounds.

References

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-oldcore >= 7.2, < 14.10.10, >= 15.0-rc-1, < 15.4-rc-1 14.10.10, 15.4-rc-1

Referencias

Puntuación CVSS 6.3/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Debilidad (CWE)
CWE-862
Plataforma
Java / Kotlin (Maven)
Paquete
org.xwiki.platform:xwiki-platform-oldcore
Publicada
04.09.2023
Actualizado
11.10.2026 13:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-m5m2-h6h9-p2c8 - CC BY 4.0

Historial de vulnerabilidades: org.xwiki.platform:xwiki-platform-oldcore

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (46) en el archivo
Entradas en total
46
Primera → última
09.2020 07.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Crítica 12
  • Alta 17
  • Media 15
  • Baja 2

Divulgaciones por año

Gravedad:
  1. XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+
    Alta CVE-2026-34151 < 17.10.5, >= 18.0.0-rc-1, < 18.2.0 17.10.5, 18.2.0
  2. XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
    Alta CVE-2026-33229 >= 17.0.0-rc-1, < 17.4.8, >= 17.5.0-rc-1, < 17.10.1 17.4.8, 17.10.1
  3. XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
    Alta CVE-2025-54125 >= 1.1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  4. XWiki leaks password hashes and other accessible password properties
    Alta CVE-2025-54124 >= 9.8-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  5. XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
    Alta CVE-2025-54385 >= 1.0, < 16.10.6, >= 17.0.0-rc1, < 17.3.0-rc-1 16.10.6, 17.3.0-rc-1
  6. XWiki allows remote code execution through preview of XClass changes in AWM editor
    Alta CVE-2025-49586 >= 7.2-milestone-2, < 16.4.7, >= 16.5.0-rc-1, < 16.10.3, >= 17.0.0-rc-1, < 17.0.0 16.4.7, 16.10.3, 17.0.0
  7. XWiki allows SQL injection in query endpoint of REST API with Oracle
    Crítica CVE-2024-56158 >= 1.0, < 15.10.16, >= 16.0.0-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.2 15.10.16, 16.4.7, 16.10.2
  8. org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
    Alta CVE-2025-32968 >= 1.6-milestone-1, < 15.10.16, >= 16.0.0-rc-1, < 16.4.6, >= 16.5.0-rc-1, < 16.10.1 15.10.16, 16.4.6, 16.10.1
  9. XWiki Platform allows XSS through XClass name in string properties
    Crítica · 9.0 CVE-2024-43400 >= 1.1.2, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  10. XWiki Platform allows remote code execution from user account
    Crítica · 9.0 CVE-2024-37899 >= 13.4.7, < 14.10.21, >= 13.10.3, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  11. XWiki Platform remote code execution from account via custom skins support
    Crítica · 9.9 CVE-2024-31987 >= 6.4-milestone-1, < 14.10.19, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.19, 15.5.4, 15.10-rc-1
  12. XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
    Crítica · 9.9 CVE-2024-31981 >= 3.0.1, < 14.10.20, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.20, 15.5.4, 15.10-rc-1
  13. XWiki has no right protection on rollback action
    Alta · 8.0 CVE-2024-21648 >= 1.0, < 14.10.17 14.10.17
  14. XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
    Alta · 8.8 CVE-2023-46243 >= 15.0, < 15.2-rc-1, >= 1.0, < 14.10.6 15.2-rc-1, 14.10.6
  15. XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
    Crítica · 9.6 CVE-2023-46242 >= 1.0, < 14.10.7, >= 15.0, < 15.2-rc-1 14.10.7, 15.2-rc-1
  16. Velocity execution without script right through VelocityCode and VelocityWiki property esta entrada
    Media · 6.3 CVE-2023-41046 >= 7.2, < 14.10.10, >= 15.0-rc-1, < 15.4-rc-1 14.10.10, 15.4-rc-1
  17. XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
    Alta · 8.0 CVE-2023-40572 >= 3.2-milestone-3, < 14.10.9, >= 15.0-rc-1, < 15.4-rc-1 14.10.9, 15.4-rc-1
  18. Upgrading doesn't prevent exploiting vulnerable XWiki documents
    Crítica · 9.9 CVE-2023-36468 >= 2.0, < 14.10.7, >= 15.0-rc-1, < 15.2-rc-1 14.10.7, 15.2-rc-1
  19. XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
    Alta · 8.4 CVE-2023-35157 >= 3.2-milestone-3, < 14.10.6, >= 15.0-rc-0, < 15.1-rc-1 14.10.6, 15.1-rc-1
  20. XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
    Crítica · 9.9 CVE-2023-29526 >= 10.11.1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.3 13.10.11, 14.4.8, 14.10.3
Mostrar más (10) Mostrando 20 de 30

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.