CVE-2023-32071

Deeper analysis

XWiki Platform, a generic wiki platform, contains a cross-site scripting vulnerability that permits execution of JavaScript in the security context of any targeted user. The flaw affects all versions from 2.2-milestone-1 through 14.4.7, 14.10.3, and 15.0-milestone releases, and stems from insufficient output encoding when an attacker supplies a crafted URL that references a page containing an attachment.

An authenticated attacker who can create or modify content can craft a URL that, when visited by a victim user, causes the victim's browser to execute attacker-controlled JavaScript under that user's privileges. Successful exploitation can therefore result in full compromise of the victim's account within the wiki, including the ability to read or alter arbitrary content and perform actions on the victim's behalf.

Official patches are available in XWiki 15.0-rc-1, 14.10.4, and 14.14.8. The project advisory and associated commit describe a one-line change to templates/importinline.vm that sanitizes the relevant input; the same modification is provided as the recommended workaround for instances that cannot be upgraded immediately.

EPSS scores for this CVE reached a peak of 0.5748 before receding to the current value of 0.3378, indicating transient but notable post-disclosure interest. No confirmed in-the-wild exploitation campaigns have been reported in the referenced sources.