CVE-2023-35158

CriticalCVSS 9.6

Published: 23/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.85%

76th percentile - higher than 76% of all known CVEs

Summary

The XWiki Platform has a vulnerability that allows the injection of JavaScript (XSS) through a forged URL. Users can exploit the restore template to perform an XSS attack, potentially leading to unauthorized access to data.

Risk Assessment

An attacker can exploit this vulnerability to execute malicious code in the user's browser context, posing a risk of data theft or session hijacking.

Recommendation

It is recommended to upgrade to XWiki version 14.10.5 or 15.1-rc-1 to mitigate this vulnerability.

Original NVD description (English source)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: > /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.