PT-2023-4714 · Unknown · Xwiki Platform

Ilie Andriuta · Published 2023-06-22 · Updated 2023-06-30 · CVE-2023-35156

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 6.0-rc-1 through 14.10.5 XWiki Platform version 14.10.6 XWiki Platform version 15.1

Description The issue allows users to forge a URL with a payload to inject Javascript in the page, enabling a cross-site scripting (XSS) attack. This can be exploited by using a URL such as "xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain)" to perform a XSS attack. The vulnerability exists since XWiki 6.0-rc-1.

Recommendations For XWiki Platform versions 6.0-rc-1 through 14.10.5, update to version 14.10.6 or 15.1 to resolve the issue. For XWiki Platform version 14.10.5, note that the partial patch provided is not enough to entirely fix the vulnerability, so updating to version 14.10.6 or 15.1 is recommended. As a temporary workaround, consider editing the template delete.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-87

Related Identifiers

BDU:2023-05140

CVE-2023-35156

GHSA-834C-X29C-F42C

Affected Products

Xwiki Platform

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35156.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-834c-x29c-f42c · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/24ec12890ac7fa6daec8d0b3435cfcba11362fd5 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/e80d22d193df364b07bab7925572720f91a8984a · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/13875a6437d4525ac4aeea25918f2d2dffac9ee1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05140 · Security Note
• https://jira.xwiki.org/browse/XWIKI-20341 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-834c-x29c-f42c · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20583 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35156 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35156 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/53370 · Telegram Post