CVE-2023-40176
Published: 23 August 2023
Summary
CVE-2023-40176 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.0 (Critical).
Operationally, ranked in the top 3.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
XWiki Platform contains a stored cross-site scripting vulnerability in its user profile handling of the time zone preference. Any registered user can store a malicious payload in this field, which is rendered without escaping when the profile is viewed. The flaw has existed since version 4.1M2, when the time zone preference was introduced, and affects the platform's runtime wiki services.
An authenticated attacker can bypass the dropdown selector by using browser developer tools or by directly invoking the profile save URL with a crafted query string. Once stored, the payload executes in the context of any user who visits the malicious profile, enabling theft of session data or escalation to programming rights under the CVSS 9.0 vector that combines network access, low complexity, and required user interaction.
The official XWiki security advisory and associated patches state that the issue is resolved in versions 14.10.5 and 15.1RC1; administrators should upgrade to these releases. The fix is documented in the referenced GitHub commit that adds proper escaping to the time zone display.
The CVE carries an EPSS score that reached a peak of 0.3658, indicating measurable post-disclosure interest among threat actors.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2299
Vulnerability details
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone…
more
user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights). This issue is present since version 4.1M2 when the time zone user preference was introduced. The issue has been fixed in XWiki 14.10.5 and 15.1RC1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.