CVE-2023-35157

XWiki Platform vulnerable to reflected cross-site scripting via delattachment action

State: Published
Severity: 8.5 High
Published: Jun 23, 2023
Updated: Nov 27, 2024
Reserved: Jun 14, 2023

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Scores

CVSS	Score	Vector	Source
3.1	8.5 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
xwiki-platformxwiki	>= 3.2-milestone-3, < 14.10.6Affected >= 15.0-rc-0, < 15.1-rc-1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.