CVE-2023-35153
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
XWiki Platform has a stored cross-site scripting (XSS) vulnerability that can be exploited by users with edit rights. Versions from 5.4.4 up to but not including 14.4.8, 14.10.4, and 15.0 are affected.
Risk Assessment
Attackers can inject malicious code, potentially leading to user data theft or session hijacking. This poses a serious threat to data security within the organization.
Recommendation
It is recommended to upgrade to XWiki versions 14.4.8, 14.10.4, or 15.0 to mitigate this vulnerability. Alternatively, a patch for `AppWithinMinutes.ClassEditSheet` can be applied.
Original NVD description (English source)
XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` class on a page and setting the payload on the page title. Then, any user visiting `/xwiki/bin/view/AppWithinMinutes/ClassEditSheet` executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update `AppWithinMinutes.ClassEditSheet` with a patch.