Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
xwiki xwiki-platform
>= 6.0-rc-1, < 14.10.6affected>= 15.0-rc-0, < 15.1affected
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-834c-x29c-f42c ↗
- https://github.com/xwiki/xwiki-platform/commit/13875a6437d4525ac4aeea25918f2d2dffac9ee1 ↗
- https://github.com/xwiki/xwiki-platform/commit/24ec12890ac7fa6daec8d0b3435cfcba11362fd5 ↗
- https://github.com/xwiki/xwiki-platform/commit/e80d22d193df364b07bab7925572720f91a8984a ↗
- https://jira.xwiki.org/browse/XWIKI-20341 ↗
- https://jira.xwiki.org/browse/XWIKI-20583 ↗
- https://jira.xwiki.org/browse/XWIKI-20672 ↗