CVE-2023-35155

HIGH NUCLEI

XWiki < 14.4.8 - Stored Cross-Site Scripting via Share Page URL Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-35155 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). For instance, the following URL execute an `alter` on the browser: `<xwiki-host>/xwiki/bin/view/Main/?viewer=share&send=1&target=&target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Crenniepak%40intigriti.me%3E&includeDocument=inline&message=I+wanted+to+share+this+page+with+you.`, where `<xwiki-host>` is the URL of your XWiki installation. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8.

Nuclei Templates (1)

XWiki - Cross-Site Scripting
MEDIUMby ritikchaddha
Shodan: html:"data-xwiki-reference"
FOFA: body="data-xwiki-reference"

References (2)

Core 2
Core References
Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://jira.xwiki.org/browse/XWIKI-20370

Scores

CVSS v3 8.8
EPSS 0.0143
EPSS Percentile 69.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
org.xwiki.platform/xwiki-platform-sharepage-api 2.6-rc-2 - 14.4.8Maven
xwiki/xwiki < 14.4.8
Published Jun 23, 2023
Tracked Since Feb 18, 2026