Lucene search

K
nvd[email protected]NVD:CVE-2023-35159
HistoryJun 23, 2023 - 7:15 p.m.

CVE-2023-35159

2023-06-2319:15:09
CWE-87
CWE-79
web.nvd.nist.gov
4
xwiki
javascript injection
xss
url
deletespace template
vulnerability
patch
version 3.4
version 14.10.5
version 15.1-rc-1

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

9.3

Confidence

High

EPSS

0.59

Percentile

97.8%

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It’s possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

Affected configurations

Nvd
Node
xwikixwikiRange3.514.10.5
OR
xwikixwikiMatch3.4milestone-1
OR
xwikixwikiMatch3.5rc-1
OR
xwikixwikiMatch15.0
VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwikixwiki3.4cpe:2.3:a:xwiki:xwiki:3.4:milestone-1:*:*:*:*:*:*
xwikixwiki3.5cpe:2.3:a:xwiki:xwiki:3.5:rc-1:*:*:*:*:*:*
xwikixwiki15.0cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

9.3

Confidence

High

EPSS

0.59

Percentile

97.8%

Related for NVD:CVE-2023-35159