CVE-2023-36470: 
Java vulnerability analysis and mitigation

CVE-2023-36470 affects XWiki Platform, a generic wiki platform offering runtime services for applications. The vulnerability was discovered in versions from 6.2-milestone-1 to versions prior to 14.10.6, and from 15.0-rc-1 to versions prior to 15.2-rc-1. The issue was disclosed on June 29, 2023, and has been patched in versions 14.10.6 and 15.1. This vulnerability allows attackers to inject XWiki syntax and Velocity code that can be executed with programming rights, potentially leading to remote code execution (GitHub Advisory).

The vulnerability stems from improper neutralization of directives in dynamically evaluated code. Attackers can exploit this through multiple vectors: injecting Velocity code in the icon set's HTML or XWiki syntax definition, using the icon picker to trigger rendering of any icon set, and manipulating the HTML output that is processed as JSON and interpreted as XWiki syntax. The vulnerability has been assigned a CVSS v3.1 score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating its severe impact (GitHub Advisory).

The vulnerability has significant impact on the confidentiality, integrity, and availability of the entire XWiki instance. Successful exploitation allows attackers to execute arbitrary code with elevated privileges, potentially leading to complete system compromise. The attack can be initiated by users with basic edit permissions, effectively enabling privilege escalation from edit rights to programming rights (GitHub Advisory).

The vulnerability has been patched in XWiki versions 14.10.6 and 15.1. The fix includes requiring script rights for icon theme authors and ensuring that code in the icon theme is executed within the context of the icon theme, preventing rights escalation. A new macro for displaying icons has been introduced to avoid injecting raw wiki syntax from icon sets into documents. There are no known workarounds apart from upgrading to a version containing the fix (GitHub Advisory).