CVE-2023-35161

Deeper analysis

XWiki Platform, a generic wiki platform, contains a cross-site scripting vulnerability in the AppWithinMinutes/DeleteApplication page that permits JavaScript injection through a crafted URL parameter such as xredirect. The flaw has existed since version 6.2-milestone-1 and allows an attacker to supply arbitrary script content that executes in the context of another user’s session.

An unauthenticated remote attacker can exploit the issue simply by inducing a victim to visit a maliciously constructed link, achieving reflected XSS with a CVSS score of 9.6. Successful exploitation can result in theft of sensitive data, session hijacking, or full compromise of the affected user’s account within the wiki instance.

Public advisories and patches indicate that the vulnerability was fixed in XWiki 14.10.5 and 15.1-rc-1; the corresponding commits and GitHub Security Advisory GHSA-4xm7-5q79-3fch document the code changes that sanitize the redirect parameter and close the injection vector.

EPSS for this CVE rose from lower values to a peak of 0.3788 on 2025-01-22 before receding to the current 0.1556, indicating a period of increased exploitation interest well after initial disclosure.