CVE-2023-35153
XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title. Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update AppWithinMinutes.ClassEditSheet with a patch.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title. Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update AppWithinMinutes.ClassEditSheet with a patch.
- Record
CVE-2023-35153- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
EUVDEUVD-2023-1691
XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title. Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update AppWithinMinutes.ClassEditSheet with a patch.
- Record
EUVD-2023-1691- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4wc6-hqv9-qc97
XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
Impact
A stored XSS can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title.
Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload.
See https://jira.xwiki.org/browse/XWIKI-20365 for me details.
Patches
The issue has been patched on XWiki 14.4.8, 14.10.4, and 15.0 ?
Workarounds
The issue can be fixed by updating AppWithinMinutes.ClassEditSheet with this patch.
References
- https://github.com/xwiki/xwiki-platform/commit/1b87fec1e5b5ec00b7a8c3c3f94f6c5e22547392#diff-79e725ec7125cced7d302e1a1f955a76745af26ef28a148981b810e85335d302
- https://jira.xwiki.org/browse/XWIKI-20365
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
Attribution
This vulnerability has been reported on Intigriti by René de Sain @renniepak.
- Record
GHSA-4wc6-hqv9-qc97- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
NVD
XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title. Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update AppWithinMinutes.ClassEditSheet with a patch.
- Record
CVE-2023-35153- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSV
XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title. Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update AppWithinMinutes.ClassEditSheet with a patch.
- Record
CVE-2023-35153- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSVGHSA-4wc6-hqv9-qc97
XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
Impact
A stored XSS can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title.
Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload.
See https://jira.xwiki.org/browse/XWIKI-20365 for me details.
Patches
The issue has been patched on XWiki 14.4.8, 14.10.4, and 15.0 ?
Workarounds
The issue can be fixed by updating AppWithinMinutes.ClassEditSheet with this patch.
References
- https://github.com/xwiki/xwiki-platform/commit/1b87fec1e5b5ec00b7a8c3c3f94f6c5e22547392#diff-79e725ec7125cced7d302e1a1f955a76745af26ef28a148981b810e85335d302
- https://jira.xwiki.org/browse/XWIKI-20365
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
Attribution
This vulnerability has been reported on Intigriti by René de Sain @renniepak.
- Record
GHSA-4wc6-hqv9-qc97- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xwiki.platform:xwiki-platform-appwithinminutes-uiMaven |
5.4.4 up to 14.4.8 | 14.4.8 |
org.xwiki.platform:xwiki-platform-appwithinminutes-uiMaven |
14.5 up to 14.10.4 | 14.10.4 |
org.xwiki.platform:xwiki-platform-appwithinminutes-uiMaven |
15.0-rc-1 up to 15.0 | 15.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-35153 is a critical vulnerability (CVSS 9.1) in Xwiki, published June 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 55th percentile. Fixed in org.xwiki.platform:xwiki-platform-appwithinminutes-ui 14.4.8.
References
github.com/xwiki/xwiki-platform/security/advisories/GHSA-4wc6-hqv9-qc97
jira.xwiki.org/browse/XWIKI-20365
nvd.nist.gov/vuln/detail/CVE-2023-35153