CVE-2023-32071

XWiki Platform contains an RXSS issue (CVE-2023-32071) that affects 2.2-milestone-1 up to versions before 14.4.8, 14.10.4, and 15.0-rc-1. The vulnerability allows executing JavaScript with the rights of any user when a user is directed to a URL on a page containing an attachment (via the importin...

CVE-2023-32071 XWiki Platform vulnerable to RXSS via editor parameter - importinline template

XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has...