CVE-2023-29524: XWiki Platform Scheduler job script code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with low privileges and no user interaction, public exploit references and a very high EPSS score, though it is not in KEV and requires an authenticated account.

What it is

XWiki Platform allows a user without script or programming rights to add an XWiki.SchedulerJobClass object to their own profile and place Groovy code in the Job Script field. That code executes in the server context when the page is viewed, giving a low-privileged user arbitrary code execution. The flaw is patched in XWiki 14.10.3 and 15.0 RC1, and no workarounds exist.

Impact

An authenticated low-privileged user gains code execution with the rights of the Scheduler Application sheet page, which can lead to full compromise of confidentiality, integrity and availability of the wiki.

Attack surface

Reached over the network through the wiki's object editor on the attacker's own user profile; the attacker needs a valid account with edit rights on their profile but no script or programming rights, and no victim interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high (0.75693, 99.5th percentile) and all references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade to XWiki 14.10.3 or 15.0 RC1 or later as the primary fix.
• If immediate upgrade is impossible, restrict who can edit user profiles and monitor for unauthorized SchedulerJobClass objects, since the vendor states there are no workarounds.
• Audit existing user profiles for XWiki.SchedulerJobClass objects and remove any unexpected ones.
• Limit Groovy and script execution rights to trusted administrators only.
• Review accounts with profile edit permissions and remove unnecessary ones.

Detection

• Search XWiki objects and page history for newly added XWiki.SchedulerJobClass objects, especially on user profile pages.
• Alert on Groovy code appearing in Scheduler job script fields or on scheduler job creation by non-administrative users.
• Monitor server-side process execution and outbound network activity originating from the XWiki application.
• Review XWiki audit logs for profile edits followed by page views that trigger scheduler jobs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.