CVE-2023-37912 XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro

What is CVE-2023-37912?

CVE-2023-37912 is a critical vulnerability in xwiki-rendering, published on 25 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and `org.xwiki.platform:xwiki-rendering-macro-footnotes` and prior to version 15.1-rc-1 of `org.xwiki.platform:xwiki-rendering-macro-footnotes`, the footnote macro executed its content in a potentially different context than the one in which it was defined. In particular in combination with the include macro, this allows privilege escalation from a simple user account in XWiki to programming rights and thus remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.6 and 15.1-rc-1. There is no workaround apart from upgrading to a fixed version of the footnote macro.

Weakness: CWE-270

Which versions are affected by CVE-2023-37912?

6 open source packages ship an affected version, including org.xwiki.rendering:xwiki-rendering-macro-footnotes and org.xwiki.platform:xwiki-core-rendering-macro-footnotes. It affects 1 product.

Products include Xwiki Xwiki-Rendering.

How do I fix CVE-2023-37912?

Upgrade org.xwiki.rendering:xwiki-rendering-macro-footnotes to a fixed version for your release line: 14.10.6 or 15.1-rc-1.

Is CVE-2023-37912 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37912 exists.

Other vulnerabilities in xwiki-rendering

• CVE-2023-37908 org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability Critical 9.1
• CVE-2025-66474 XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-35j5-m29r-xfq5.