9.7

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-35161

GHSA ID

GHSA-4xm7-5q79-3fch

EPSS Score

0.86858%

CWE

CWE-79

Published

6/22/2023

Updated

11/12/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-35161

CVE-2023-35161: XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page

Impact

Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:

xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain)

This vulnerability exists since XWiki 6.2-milestone-1.

Patches

The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

Workarounds

It's possible to workaround the vulnerability by editing the page AppWithinMinutes.DeleteApplication to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets.

References

Jira ticket about the vulnerability: https://jira.xwiki.org/browse/XWIKI-20614
Introduction of the macro used for fixing all those vulnerabilities: https://jira.xwiki.org/browse/XWIKI-20583
Commit containing the actual fix in the page: https://github.com/xwiki/xwiki-platform/commit/8f5a889b7cd140770e54f5b4195d88058790e305

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-35161

CVE-2023-35161:

9.7

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-35161

GHSA ID

GHSA-4xm7-5q79-3fch

EPSS Score

0.86858%

CWE

CWE-79

Published

6/22/2023

Updated

11/12/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-appwithinminutes-ui	maven	>= 6.2-milestone-1, < 14.10.5	14.10.5
org.xwiki.platform:xwiki-platform-appwithinminutes-ui	maven	>= 15.0-rc-1, < 15.1-rc-1	15.1-rc-1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from unsanitized use of the xredirect parameter in the DeleteApplication.xml Velocity template. The pre-patch code (shown in the commit diff) directly assigned $cancelURL = $request.xredirect and propagated this value into URL parameters. This lack of validation allowed JavaScript URI schemes like 'javascript:alert()' to be executed. The fix introduced #getSanitizedURLAttributeValue to sanitize the URL, confirming that the original code lacked proper input validation. The Jira tickets (XWIKI-20614/XWIKI-20583) explicitly reference the need for URL sanitization in templates, and the CWE-79/CWE-87 classifications match this XSS pattern.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-35161: XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page

Impact

Patches

Workarounds

References

For more information

CVE-2023-35161:

9.7

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

9.7

9.7

Basic Information

Basic Information

CVE-2023-35161: XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page

Impact

Patches

Workarounds

References

For more information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI