CVE-2023-35156: Improper Neutralization of Alternate XSS Syntax

🗓️ 23 Jun 2023 00:00:00Reported by Rapid7Type

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to...

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, stems from the lack of measures to neutralize XSS alternative syntax. This allows attackers to replace the displayed URL with their own malicious content.	4 Sep 202300:00	–	bdu_fstec
CNNVD	XWiki Platform 跨站脚本漏洞	23 Jun 202300:00	–	cnnvd
CVE	CVE-2023-35156	23 Jun 202318:19	–	cve
Cvelist	CVE-2023-35156 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template	23 Jun 202318:19	–	cvelist
EUVD	EUVD-2023-1742	3 Oct 202520:07	–	euvd
Github Security Blog	XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template	22 Jun 202319:59	–	github
Nuclei	XWiki >= 6.0-rc-1 - Cross-Site Scripting	22 Sep 202602:05	–	nuclei
NVD	CVE-2023-35156	23 Jun 202319:15	–	nvd
OSV	GHSA-834C-X29C-F42C XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template	22 Jun 202319:59	–	osv
Prion	Code injection	23 Jun 202319:15	–	prion