CVE-2023-35160

🗓️ 23 Jun 2023 18:48:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 80 Views🌐 WEB

XWiki Platform allows XSS through forged URLs. Vulnerable versions: 2.5-milestone-2 to 14.10.5 and 15.1-rc-1

Reporter	Title	Published	Views	Family All 10
CNNVD	XWiki Platform 跨站脚本漏洞	23 Jun 202300:00	–	cnnvd
Cvelist	CVE-2023-35160 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template	23 Jun 202318:48	–	cvelist
EUVD	EUVD-2023-1876	3 Oct 202520:07	–	euvd
Github Security Blog	XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template	22 Jun 202319:59	–	github
Nuclei	XWiki >= 2.5-milestone-2 - Cross-Site Scripting	6 Jun 202603:01	–	nuclei
NVD	CVE-2023-35160	23 Jun 202319:15	–	nvd
OSV	CVE-2023-35160 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template	23 Jun 202318:48	–	osv
OSV	GHSA-R8XC-XXH3-Q5X3 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template	22 Jun 202319:59	–	osv
Prion	Code injection	23 Jun 202319:15	–	prion
Vulnrichment	CVE-2023-35160 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template	23 Jun 202318:48	–	vulnrichment

NVD

Vulners

Node

xwiki xwikiRange3.0–14.10.5

xwiki xwikiMatch2.5milestone2

xwiki xwikiMatch15.0

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 2.5-milestone-2, < 14.10.5",
        "status": "affected"
      },
      {
        "version": ">= 15.0-rc-1, < 15.1-rc-1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
jira	www.jira.xwiki.org/browse/XWIKI-20343
jira	www.jira.xwiki.org/browse/XWIKI-20583
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-r8xc-xxh3-q5x3
github	www.github.com/xwiki/xwiki-platform/commit/dbc92dcdace33823ffd1e1591617006cb5fc6a7f

Parameter	Position	Path	Description	CWE
xpage	query param	xwiki/bin/view/XWiki/Main	XWiki XSS via resubmit template where attacker injects JavaScript through URL parameters.	CWE-87, CWE-79
resubmit	query param	xwiki/bin/view/XWiki/Main	XWiki XSS via resubmit template where attacker injects JavaScript through URL parameters.	CWE-87, CWE-79
xback	query param	xwiki/bin/view/XWiki/Main	XWiki XSS via resubmit template where attacker injects JavaScript through URL parameters.	CWE-87, CWE-79

21 Nov 2024 08:08Current

7.6High risk

Vulners AI Score7.6

CVSS 3.16.1 - 9.6

EPSS0.12069

SSVC