CVSS 3.1
4.8 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NCVE-2023-35157
Medium (4.8) in xwiki xwiki. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in org.xwiki.platform:xwiki-platform-oldcore 14.10.6, 15.1-rc-1.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-79, CWE-80
- Published
- Modified
- Record from
- the NVD, synced
Affected
- xwiki:xwiki
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-phwm-87rg-27qq | Maven | org.xwiki.platform:xwiki-platform-oldcore | >=3.2-milestone-3 <14.10.6 | 14.10.6 |
| GHSA-phwm-87rg-27qq | Maven | org.xwiki.platform:xwiki-platform-oldcore | >=15.0-rc-0 <15.1-rc-1 | 15.1-rc-1 |
References
- https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qq
- https://jira.xwiki.org/browse/XWIKI-20339
- https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qq