CVE-2022-23616 Remote code execution in xwiki-platform
Unprivileged users can execute remote code by injecting Groovy scripts into their profile via the password reset feature.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23616?
CVE-2022-23616 is a high-severity code injection vulnerability in Xwiki Xwiki, published on 9 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki. The issue has been patched in XWiki 13.1RC1. There are two different possible workarounds, each consisting of modifying the XWiki/ResetPassword page. 1. The Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page. 2. The script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password.
Weakness: CWE-74
Which versions are affected by CVE-2022-23616?
2 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-administration-ui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.xwiki.platform:xwiki-platform-administration-ui Maven | From 3.1-milestone-1 | 13.1RC1 |
org.xwiki.platform:xwiki-platform-administration-ui Maven | From 3.1-milestone-1 | 13.1RC1 |
Products include Xwiki Xwiki.
How do I fix CVE-2022-23616?
Upgrade org.xwiki.platform:xwiki-platform-administration-ui to 13.1RC1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-23616 being exploited?
There is no known exploitation of CVE-2022-23616 in the wild and no public exploit code.
Other vulnerabilities in Xwiki Xwiki
- CVE-2025-24893 XWiki Platform Eval Injection
- CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros
- CVE-2024-55662 XWiki allows remote code execution through the extension sheet
- CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
- CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
Sources
Also known as GHSA-mgjw-2wrp-r535.