Log in Start free

Vulnerability · Published Jun 23, 2023 · Assigned by GitHub_M

CVE-2023-35153XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters

Critical 9.1

In plain English

A critical-severity cross-site scripting in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` class on a page and setting the payload on the page title. Then, any user visiting `/xwiki/bin/view/AppWithinMinutes/ClassEditSheet` executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update `AppWithinMinutes.ClassEditSheet` with a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.xwiki.platform:xwiki-platform-appwithinminutes-ui14.4.8GHSA-4wc6-hqv9-qc97
Mavenorg.xwiki.platform:xwiki-platform-appwithinminutes-ui14.10.4GHSA-4wc6-hqv9-qc97
Mavenorg.xwiki.platform:xwiki-platform-appwithinminutes-ui15.0GHSA-4wc6-hqv9-qc97

Affected products (as reported)

VendorProductVersions
xwiki xwiki-platform >= 5.4.4, < 14.4.8 >= 14.5, < 14.10.4>= 15.0-rc-1, < 15.0

Weakness: CWE-79, CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References