CVE-2023-35160

Deeper analysis

XWiki Platform contains a reflected cross-site scripting vulnerability in its resubmit template that permits an attacker to inject arbitrary Javascript into a rendered page by supplying a crafted URL containing xpage=resubmit along with resubmit and xback parameters. The flaw has existed since version 2.5-milestone-2 and affects any deployment that has not been updated past the affected releases.

An unauthenticated remote attacker can exploit the issue simply by inducing a victim to click a malicious link, resulting in Javascript execution in the victim's browser context with the ability to read or modify page content and perform actions on behalf of the user. The CVSS 9.6 score reflects the combination of network attack vector, lack of required privileges, and full impact across confidentiality, integrity, and availability when the attack succeeds.

Advisories and patches published by the project state that the vulnerability is resolved in XWiki 14.10.5 and 15.1-rc-1; the corresponding commits and Jira issues XWIKI-20343 and XWIKI-20583 document the code change that removes the unsafe resubmit handling.

The EPSS probability rose from a low baseline to a peak of 0.3788 on 2025-01-22 before receding to the current value of 0.1207, indicating that exploitation interest increased measurably after public disclosure.