CVE-2023-35159
CriticalCVSS 9.6Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
XWiki Platform allows users to forge URLs with payloads that enable JavaScript injection on the page (XSS). The deletespace template can be exploited to perform an XSS attack, for example using the URL: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain).
Risk Assessment
Exploitation of this vulnerability may lead to user data theft or session hijacking. Organizations should be aware of the risks associated with malicious code injection.
Recommendation
It is recommended to upgrade to XWiki version 14.10.5 or 15.1-rc-1 to mitigate this vulnerability. A security audit of applications using XWiki should also be conducted.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.