CVE-2023-32071: Improper Encoding or Escaping of Output
XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it’s possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file <xwiki app>/templates/importinline.vm and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.
References
- app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYK
- github.com/advisories/GHSA-j9h5-vcgv-2jfm
- github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01
- github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfm
- jira.xwiki.org/browse/XWIKI-20340
- nvd.nist.gov/vuln/detail/CVE-2023-32071
Code Behaviors & Features
Detect and mitigate CVE-2023-32071 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →