Patchfirst
Patchfirst
CVE-2023-32071 Critical · 9.1 EPSS 70.4%

XWiki Platform vulnerable to RXSS via editor parameter - importinline template

xwiki · xwiki-platform

Summary

The reflected cross-site scripting flaw lives in the importinline template of the XWiki Platform (xwiki-platform) product, where the editor parameter is not properly neutralised in generated output. An attacker who can lure a user to a specially crafted URL pointing at a page that contains an attachment, and who requires some user interaction and low privileges to do so, can execute JavaScript with that user's rights, with high impact to confidentiality, integrity and availability.

Official description · CVE.org

XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.

Breakdown
26.2 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 9 May 2023. No public exploit code or confirmed exploitation is recorded.

2 related vulnerabilities in the same code over 3 weeks. The latest fix listed for xwiki-platform-distribution-war is 17.3.0-rc-1.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2023-29512Code injection in xwiki-platform-web-templates18 Apr 2023
  2. relatedMedium

    Why these are linked:

    This CVECVE-2023-32071XWiki Platform vulnerable to RXSS via editor parameter…9 May 2023

Fixes in xwiki-platform-distribution-warMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 14.3-rc-1CVE-2024-5566312 Dec 2024
  2. 14.6-rc-1CVE-2023-2952518 Apr 2023
  3. 14.10.4CVE-2023-320719 May 2023
  4. 15.8-rc-1CVE-2024-216518 Jan 2024
  5. 17.3.0-rc-1CVE-2025-3242924 Jul 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-distribution-war.

Mavenorg.xwiki.platform:xwiki-platform-distribution-warGHSA-j9h5-vcgv-2jfm

Upgrade to 14.10.4

Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-29525).

Still affected on this line by CVE-2025-32429 (fixed in 16.10.6, a newer line).

Set the version to 14.10.4 or later in your pom.xml or build.gradle.

The first fix for CVE-2023-32071.

Affected versions, by release line

If you runUpgrade to
14.5 up to 14.10.414.10.4
2.2-milestone-1 up to 14.4.8

Still affected on this line by CVE-2025-32429 (fixed in 16.10.6, a newer line).

14.4.8

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfm

x_refsource_MISC 3

github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYKjira.xwiki.org/browse/XWIKI-20340
↑ ↓ chooseEnter openEsc close