Vulnerability · Published Jun 23, 2023 · Assigned by GitHub_M
CVE-2023-35157XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
High 8.5
In plain English
A high-severity cross-site scripting in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 14.10.6 | GHSA-phwm-87rg-27qq |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 15.1-rc-1 | GHSA-phwm-87rg-27qq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 3.2-milestone-3, < 14.10.6>= 15.0-rc-0, < 15.1-rc-1 |
Weakness: CWE-80, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qq x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-20339 x_refsource_MISC