Lucene search

[email protected]NVD:CVE-2023-35159

HistoryJun 23, 2023 - 7:15 p.m.

CVE-2023-35159

2023-06-2319:15:09

CWE-87

CWE-79

[email protected]

web.nvd.nist.gov

xwiki

javascript injection

xss

url

deletespace template

vulnerability

patch

version 3.4

version 14.10.5

version 15.1-rc-1

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

9.3

Confidence

High

EPSS

0.55

Percentile

97.7%

JSON

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It’s possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

Affected configurations

Nvd

Node

xwikixwikiRange3.5–14.10.5

xwikixwikiMatch3.4milestone-1

xwikixwikiMatch3.5rc-1

xwikixwikiMatch15.0

VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwikixwiki3.4cpe:2.3:a:xwiki:xwiki:3.4:milestone-1:*:*:*:*:*:*
xwikixwiki3.5cpe:2.3:a:xwiki:xwiki:3.5:rc-1:*:*:*:*:*:*
xwikixwiki15.0cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::
xwiki	xwiki	3.4	cpe:2.3:a:xwiki:xwiki:3.4:milestone-1::::::
xwiki	xwiki	3.5	cpe:2.3:a:xwiki:xwiki:3.5:rc-1::::::
xwiki	xwiki	15.0	cpe:2.3:a:xwiki:xwiki:15.0:::::::*