CVE-2023-32071

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79 CWE-116

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 2.2-milestone-1, < 14.4.8; >= 14.5, < 14.10.4

References

https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYKPermissions Required
https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfmVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20340Vendor Advisory
https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYKPermissions Required
https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfmVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20340Vendor Advisory

Timeline

Published: May 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-320724.8Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version CVE-2023-320738.8WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/clon CVE-2023-320749.8user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended tha CVE-2023-320754.3The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framewo CVE-2023-320765.5in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to con CVE-2023-320777.5Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing una CVE-2023-320787.5Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0 CVE-2023-320798.8Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-a CVE-2023-32088.8A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3. Affected by this i CVE-2023-320808.8Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11 CVE-2023-320816.5Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 CVE-2023-320824.3etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allo