CVE-2023-35156

Deeper analysis

XWiki Platform contains a reflected cross-site scripting vulnerability in its delete template that permits arbitrary JavaScript injection through a crafted URL parameter. The flaw, present since version 6.0-rc-1, can be triggered via requests such as /bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:..., allowing an attacker-supplied script to execute in the context of the wiki page. It is tracked under CWE-79 and CWE-87 and carries a CVSS 3.1 score of 9.6.

An unauthenticated remote attacker can exploit the issue by supplying a malicious link that a victim user follows, resulting in script execution that can read or modify content, hijack sessions, or perform actions with the privileges of the targeted user. Because the vulnerability affects a core template used across many XWiki instances, successful exploitation can lead to full compromise of confidentiality, integrity, and availability within the affected wiki.

The project’s security advisory GHSA-834c-x29c-f42c and associated commits document that the issue was fully addressed in XWiki 14.10.6 and 15.1 after an incomplete mitigation in 14.10.5; administrators are advised to upgrade to one of the patched releases. The EPSS score rose from a low baseline to a peak of 0.1209, indicating measurable post-disclosure exploitation interest.