CVE-2023-35160
CriticalCVSS 9.6Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript code through forged URLs. Exploiting the resubmit template enables the execution of malicious code, potentially leading to user data exposure.
Risk Assessment
An attacker could exploit this vulnerability to hijack user sessions or steal data, posing a serious threat to the security of the application and the organization's data.
Recommendation
It is recommended to update XWiki to version 14.10.5 or 15.1-rc-1 to eliminate this vulnerability and secure the application against potential attacks.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/XWiki/Main xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.