PT-2023-4712 · Xwiki · Xwiki Platform

Michitux

·

Published

2023-08-21

·

Updated

2023-08-29

·

CVE-2023-40176

CVSS v3.1

9.0

Critical

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions XWiki Platform versions 4.1M2 through 14.10.4 XWiki Platform versions prior to 14.10.5 and 15.1RC1
Description The issue is related to a stored XSS vulnerability that can be exploited by any registered user through their user profile by setting the payload as the value of the time zone user preference. This can be done using JavaScript or by calling the save URL on the user profile with the right query string. Once the time zone is set, it is displayed without escaping, allowing the payload to be executed for any user that visits the malicious user profile. This enables the attacker to steal information and gain more access rights.
Recommendations For XWiki Platform versions 4.1M2 through 14.10.4, edit the displayer timezone.vm file and escape the displayed time zone value by replacing $!value with $!escapetool.xml($value). For XWiki Platform versions prior to 14.10.5 and 15.1RC1, update to version 14.10.5 or 15.1RC1 to fix the issue. As a temporary workaround, consider restricting access to the user profile feature until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05138
CVE-2023-40176
GHSA-H8CM-3V5F-RGP6

Affected Products

Xwiki Platform