CVE-2023-35153

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` class on a page and setting the payload on the page title. Then, any user visiting `/xwiki/bin/view/AppWithinMinutes/ClassEditSheet` executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update `AppWithinMinutes.ClassEditSheet` with a patch.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-80

Affected software

No affected versions have been published.

Timeline

Published
Jun 23, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-351546.5Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can rCVE-2023-351556.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL withCVE-2023-351566.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL withCVE-2023-351574.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by CVE-2023-351586.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL withCVE-2023-351596.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL withCVE-2023-351606.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL withCVE-2023-351616.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL withCVE-2023-351626.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL withCVE-2023-351635.2Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulCVE-2023-351646.5DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a miCVE-2023-351658.8AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it
CVE-2023-35153: Medium severity, CVSS 5.4 | Vulnix