PT-2023-4708 · Unknown · Xwiki Platform

Simon Urli · Published 2023-06-22 · Updated 2025-03-17 · CVE-2023-35161

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 6.2-milestone-1 through 14.10.4 XWiki Platform versions 15.1-rc-1 and earlier

Description The issue allows users to forge a URL with a payload that injects Javascript into the page, enabling a cross-site scripting (XSS) attack. This can be exploited using the DeleteApplication page. For example, a URL such as "xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain)" can be used. The vulnerability exists due to the lack of measures to neutralize alternative XSS syntax.

Recommendations For XWiki Platform versions 6.2-milestone-1 through 14.10.4, update to version 14.10.5 or later. For XWiki Platform versions 15.1-rc-1 and earlier, update to version 15.1 or later. As a temporary workaround, consider editing the page AppWithinMinutes.DeleteApplication to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-87

Related Identifiers

BDU:2023-05134

CVE-2023-35161

GHSA-4XM7-5Q79-3FCH

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35161.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4xm7-5q79-3fch · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/8f5a889b7cd140770e54f5b4195d88058790e305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35161 · Security Note
• https://jira.xwiki.org/browse/XWIKI-20583 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20614 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35161 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4xm7-5q79-3fch · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05134 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/csirt_italia/2296 · Telegram Post