Michael Hamann
·
Published
2025-08-05
·
Updated
2025-08-06
·
CVE-2025-32430
6.5
Medium
| Base vector | Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions:
XWiki Platform versions 4.2-milestone-3 through 16.4.7
XWiki Platform versions 16.5.0-rc-1 through 16.10.5
XWiki Platform versions 17.0.0-rc-1 through 17.2.2
Description:
The platform contains reflected cross-site scripting (XSS) vulnerabilities in two templates. An attacker can execute malicious JavaScript code in the context of a victim's session by getting the victim to visit a crafted URL. This allows the attacker to perform actions using the victim's permissions. The issue is exploitable through URLs such as `/xwiki/bin/view/Main/?xpage=job status json&jobId=asdf&translationPrefix=<img src=1 onerror=alert(document.domain)>` and `/xwiki/bin/view/Main/?xpage=distribution&extensionId=%3Cimg src=x onerror=alert(document.domain)%3E&extensionVersionConstraint=%3Cimg src=x onerror=alert(document.domain)%3E`.
Recommendations:
XWiki Platform versions prior to 16.4.8
XWiki Platform versions prior to 16.10.6
XWiki Platform versions prior to 17.3.0-rc-1
Manually patch the WAR file with the changes included in the original patch.
Fix
XSS