{"cve":"CVE-2023-35157","nvd":{"published":"2023-06-23T19:15:09.343","modified":"2026-06-17T06:04:31.017","status":"Modified","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","score":4.8},"cwes":["CWE-79","CWE-80"],"references":["https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qq","https://jira.xwiki.org/browse/XWIKI-20339","https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qq"],"products":["xwiki:xwiki"],"source":"nvd","synced_at":"2026-10-19T21:38:30.124994567+00:00"},"epss":{"cve":"CVE-2023-35157","score":0.00633,"percentile":0.50362,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-phwm-87rg-27qq","url":"https://osv.dev/vulnerability/GHSA-phwm-87rg-27qq","summary":"XWiki Platform vulnerable to reflected cross-site scripting via delattachment action","modified":"2026-09-10T03:50:08.464737963Z","packages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-oldcore","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore","ranges":[">=3.2-milestone-3 <14.10.6"],"fixed":["14.10.6"]},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-oldcore","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore","ranges":[">=15.0-rc-0 <15.1-rc-1"],"fixed":["15.1-rc-1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}