Cross site scripting

🗓️ 23 Jun 2023 15:15:00Reported by PRIOn knowledge baseType

XWiki Platform up to version 15.1RC1 allows stored cross-site scripting via user profile editing, leading to arbitrary actions with user's rights. Patched in versions 14.4.8, 14.10.5, 15.1RC1

Reporter	Title	Published	Views	Family All 10
CNNVD	XWiki Platform 跨站脚本漏洞	23 Jun 202300:00	–	cnnvd
CVE	CVE-2023-34464	23 Jun 202314:44	–	cve
Cvelist	CVE-2023-34464 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template	23 Jun 202314:44	–	cvelist
EUVD	EUVD-2023-1787	3 Oct 202520:07	–	euvd
Github Security Blog	XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template	20 Jun 202316:44	–	github
NVD	CVE-2023-34464	23 Jun 202315:15	–	nvd
OSV	CVE-2023-34464 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template	23 Jun 202314:44	–	osv
OSV	GHSA-FP7H-F9F5-X4Q7 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template	20 Jun 202316:44	–	osv
RedhatCVE	CVE-2023-34464	23 May 202502:06	–	redhatcve
Vulnrichment	CVE-2023-34464 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template	23 Jun 202314:44	–	vulnrichment

Source	Link
github	www.github.com/xwiki/xwiki-platform/commit/53e8292a31ec70fba5e1d705a4ac443658b9e6df
jira	www.jira.xwiki.org/browse/XWIKI-20290
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp7h-f9f5-x4q7