CVE-2023-35162

Deeper analysis

XWiki Platform, a generic wiki runtime, contains a reflected cross-site scripting vulnerability (CWE-79) that permits arbitrary JavaScript injection through the previewactions.vm template. The flaw has existed since version 6.1-rc-1 and is triggered when an attacker-supplied xcontinue parameter containing a javascript: URI is processed by the /bin/get/ endpoint, as demonstrated by URLs such as /xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain).

An unauthenticated remote attacker can exploit the issue by crafting a malicious link and inducing a victim to open it; because the script executes in the context of the XWiki origin with changed scope, successful exploitation can result in theft of session tokens, account takeover, or arbitrary actions on behalf of the targeted user, consistent with the CVSS 9.6 rating.

Official patches are available in XWiki 14.10.5 and 15.1-rc-1; the project advisory and associated commits on GitHub document the fix and recommend immediate upgrade for all affected instances.

EPSS scores for this CVE rose from low values after disclosure to a peak of 0.3688 on 2025-01-22 before receding to the current 0.1556, indicating a clear post-publication increase in observed exploitation interest.