Every CVE Search/ Get API key

CVE-2023-35157

XWiki Platform vulnerable to reflected cross-site scripting via delattachment action

8.5 HighFix available

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.63%Up 0.6 points since Jun 24, 2023
90%50%10%1%

What each source reports

CVE List Score used 8.5

XWiki Platform vulnerable to reflected cross-site scripting via delattachment action

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Record
CVE-2023-35157
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-80, CWE-79
Updated
2026-11-02
EUVDEUVD-2023-1855 8.5

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Record
EUVD-2023-1855
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-phwm-87rg-27qq 8.4

XWiki Platform vulnerable to reflected cross-site scripting via delattachment action

Impact

It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token.

Patches

The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Workarounds

There's no workaround for this other than upgrading XWiki.

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-phwm-87rg-27qq
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79, CWE-80
Updated
2026-11-02
NVD 8.4

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Record
CVE-2023-35157
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSV 8.4

XWiki Platform vulnerable to reflected cross-site scripting via delattachment action

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Record
CVE-2023-35157
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSVGHSA-phwm-87rg-27qq 8.4

XWiki Platform vulnerable to reflected cross-site scripting via delattachment action

Impact

It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token.

Patches

The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Workarounds

There's no workaround for this other than upgrading XWiki.

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-phwm-87rg-27qq
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79, CWE-80
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.xwiki.platform:xwiki-platform-oldcore
Maven
 3.2-milestone-3 up to 14.10.6
14.10.6
org.xwiki.platform:xwiki-platform-oldcore
Maven
 15.0-rc-0 up to 15.1-rc-1
15.1-rc-1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-35157 is a high vulnerability (CVSS 8.5) in Xwiki, published June 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in org.xwiki.platform:xwiki-platform-oldcore 14.10.6.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open