CVE-2023-35162
CriticalCVSS 9.6Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
XWiki Platform has a vulnerability allowing for XSS attacks by injecting JavaScript through a forged URL. This can be exploited using the previewactions template, potentially executing unauthorized code on the page.
Risk Assessment
Exploitation of this vulnerability may lead to user data theft or session hijacking, posing a significant security risk to the organization.
Recommendation
It is recommended to upgrade to XWiki version 14.10.5 or 15.1-rc-1 to mitigate this vulnerability.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: > <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.