CVE-2023-35156

Katalog CVE

CVSS 6.1 · Medium EPSS 2,1%

Kerentanan Improper Neutralization of Alternate XSS Syntax pada xwiki. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability.

Rincian

Terbit di NVD

23 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-87: Improper Neutralization of Alternate XSS Syntax
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xwiki/xwiki-platform/commit/13875a6437d4525ac4aeea25918f2d2dffac9ee1 patch · advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/24ec12890ac7fa6daec8d0b3435cfcba11362fd5 patch · advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/e80d22d193df364b07bab7925572720f91a8984a patch · advisory vendor
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-834c-x29c-f42c advisory vendor
• https://jira.xwiki.org/browse/XWIKI-20341 issue tracking · advisory vendor
• https://jira.xwiki.org/browse/XWIKI-20583 issue tracking · advisory vendor
• https://jira.xwiki.org/browse/XWIKI-20672 issue tracking · advisory vendor