{"id":"CVE-2023-32071","published":"2023-05-09T15:42:16Z","modified":"2025-01-28T16:36:40Z","title":"XWiki Platform vulnerable to RXSS via editor parameter - importinline template","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 2.2-milestone-1, < 14.4.8",">= 14.5, < 14.10.4"]}],"description":{"text":"XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.","provenance":"source","from":"CVE.org"},"summary":{"text":"The reflected cross-site scripting flaw lives in the importinline template of the XWiki Platform (xwiki-platform) product, where the editor parameter is not properly neutralised in generated output. An attacker who can lure a user to a specially crafted URL pointing at a page that contains an attachment, and who requires some user interaction and low privileges to do so, can execute JavaScript with that user's rights, with high impact to confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:15:12Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.70386,"percentile":0.99386,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-116","name":"Improper Encoding or Escaping of Output"},{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01","tags":["x_refsource_MISC"]},{"url":"https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYK","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20340","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=2.2-milestone-1, <14.4.8",">=14.5, <14.10.4"],"patched":["14.4.8","14.10.4"],"from":["GHSA-j9h5-vcgv-2jfm"],"provenance":"source"}],"advisories":[{"id":"GHSA-j9h5-vcgv-2jfm","url":"https://github.com/advisories/GHSA-j9h5-vcgv-2jfm","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=2.2-milestone-1, <14.4.8"],"patched":["14.4.8"],"provenance":"source","from":"GHSA"},{"id":"GHSA-j9h5-vcgv-2jfm","url":"https://github.com/advisories/GHSA-j9h5-vcgv-2jfm","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=14.5, <14.10.4"],"patched":["14.10.4"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-1567","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1567","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-05-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-32071","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9939"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-xwiki-platform-cve-2023-29512","parents":[{"from":"CVE-2023-29512","to":"CVE-2023-32071","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/importinline.vm"],"commits":["https://github.com/xwiki/xwiki-platform/commit/e4bbdc23fea0be4ef1921d1a58648028ce753344","https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2024-55663","published":"2024-12-12","fixed":"14.3-rc-1","kev":false},{"cve":"CVE-2023-29525","published":"2023-04-18","fixed":"14.6-rc-1","kev":false,"link":{"from":"CVE-2023-29525","to":"CVE-2023-32071","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-distribution-war","fromFixed":"14.6-rc-1","toFixed":"14.10.4","daysApart":21}]}},{"cve":"CVE-2023-32071","published":"2023-05-09","fixed":"14.10.4","kev":false},{"cve":"CVE-2024-21651","published":"2024-01-08","fixed":"15.8-rc-1","kev":false,"link":{"from":"CVE-2023-32071","to":"CVE-2024-21651","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-distribution-war","fromFixed":"14.10.4","toFixed":"14.10.18","daysApart":244}]}},{"cve":"CVE-2025-32429","published":"2025-07-24","fixed":"17.3.0-rc-1","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-distribution-war"}}