QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2023-32071

Back to search

CVE-2023-32071

Published: May 9, 2023

Modified: Jan 28, 2025

PUBLISHED

CVSS v3.1

9.1

CRITICAL

Description

XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.

VendorProductVersions

xwiki

xwiki-platform

affected
>= 2.2-milestone-1, < 14.4.8
affected
>= 14.5, < 14.10.4

Weaknesses (CWE)

CWE-116
CWE-79

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now