XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability.
Metrics
Affected Vendors & Products
References
History
Wed, 27 Nov 2024 21:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-06-23T18:19:56.802Z
Updated: 2024-11-27T20:12:17.092Z
Reserved: 2023-06-14T14:17:52.178Z
Link: CVE-2023-35156
Vulnrichment
Updated: 2024-08-02T16:23:59.439Z
NVD
Status : Modified
Published: 2023-06-23T19:15:09.263
Modified: 2024-11-21T08:08:03.197
Link: CVE-2023-35156
Redhat
No data.