CVE-2023-35156
CriticalCVSS 9.6Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript through a forged URL. Exploiting the delete template enables XSS attacks, which may lead to unauthorized access to user data.
Risk Assessment
Organizations using XWiki may be exposed to attacks that could result in the disclosure of sensitive information or session hijacking. Exploiting this vulnerability poses a threat to the integrity and confidentiality of data.
Recommendation
It is recommended to upgrade to XWiki version 14.10.6 or 15.1 to eliminate this vulnerability. Users should also consider implementing additional security measures to minimize the risk of XSS attacks.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability.