CVE-2023-45136
Published: 25 October 2023
Summary
CVE-2023-45136 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.6 (Critical).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
XWiki Platform is affected by a reflected cross-site scripting vulnerability in the page creation form when document names are validated according to a name strategy, which is disabled by default. The issue impacts versions starting with 12.0-rc-1 and prior to 12.10.12 and 15.5-rc-1, and stems from insufficient escaping in the createinline.vm template that is included in the platform WAR file. The vulnerability carries a CVSS score of 9.6 and is tracked under CWE-79.
An unauthenticated attacker can exploit the flaw by crafting a malicious link that triggers arbitrary script execution in the context of any user who opens it. Depending on the targeted user's rights, this can result in remote code execution along with complete read and write access across the XWiki installation.
Security advisories and patches direct administrators to upgrade to XWiki 14.10.12 or 15.5-rc-1, which add the required escaping. The same changes can be applied manually to the vulnerable template for environments that cannot perform a full upgrade.
The EPSS score has reached a peak of 0.7496 with a current value of 0.7069.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2794
Vulnerability details
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12…
more
and 15.5-rc-1 is vulnerable to a reflected cross-site scripting attack in the page creation form. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation. This has been patched in XWiki 14.10.12 and 15.5-rc-1 by adding appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.