CVE-2023-35161
CriticalCVSS 9.6Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
XWiki Platform allows users to forge URLs with payloads, enabling JavaScript injection on the page (XSS). The DeleteApplication page can be exploited to perform an XSS attack using a specially crafted URL.
Risk Assessment
Exploitation of this vulnerability could lead to user data theft or session hijacking, posing a significant threat to the security of the application and the organization's data.
Recommendation
It is recommended to update XWiki to version 14.10.5 or 15.1-rc-1 to mitigate this vulnerability. A security audit of the application should also be conducted to identify potential weaknesses.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.