XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters

中 5.4CVE-2023-35153 · GHSA-4wc6-hqv9-qc97 · 23/06/2023 公開 · 17/06/2026 更新

要点

CVE-2023-35153 は org.xwiki.platform:xwiki-platform-appwithinminutes-ui, xwiki (xwiki) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.74%（全脆弱性の 54.7% より高い）。
対処：14.10.4, 15.0, 14.4.8 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.xwiki.platform:xwiki-platform-appwithinminutes-ui Maven	`≥ 14.5, < 14.10.4≥ 15.0-rc-1, < 15.0≥ 5.4.4, < 14.4.8`	`14.10.415.014.4.8`
xwiki xwiki	`= 15.0≥ 14.10, < 14.10.4≥ 5.4.4, < 14.4.8`	`14.10.414.4.8`

概要

Impact

A stored XSS can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title. Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload.

See https://jira.xwiki.org/browse/XWIKI-20365 for me details.

Patches

The issue has been patched on XWiki 14.4.8, 14.10.4, and 15.0 ?

Workarounds

The issue can be fixed by updating AppWithinMinutes.ClassEditSheet with this patch.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Attribution

This vulnerability has been reported on Intigriti by René de Sain @renniepak.

NVD の説明

XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` class on a page and setting the payload on the page title. Then, any user visiting `/xwiki/bin/view/AppWithinMinutes/ClassEditSheet` executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update `AppWithinMinutes.ClassEditSheet` with a patch.