| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-appwithinminutes-ui | ≥ 14.5, < 14.10.4≥ 15.0-rc-1, < 15.0≥ 5.4.4, < 14.4.8 | 14.10.415.014.4.8 |
| xwiki | = 15.0≥ 14.10, < 14.10.4≥ 5.4.4, < 14.4.8 | 14.10.414.4.8 |
A stored XSS can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title.
Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload.
See https://jira.xwiki.org/browse/XWIKI-20365 for me details.
The issue has been patched on XWiki 14.4.8, 14.10.4, and 15.0 ?
The issue can be fixed by updating AppWithinMinutes.ClassEditSheet with this patch.
If you have any questions or comments about this advisory:
This vulnerability has been reported on Intigriti by René de Sain @renniepak.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free