Sign in
Deutsch English Español Polski
Critical

XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template

  • Disclosed: 22.06.2023
  • Updated: 11.10.2026 13:20

Impact

Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as:

xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain)

This vulnerability exists since XWiki 3.4-milestone-1.

Patches

The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

Workarounds

It's possible to workaround the vulnerability by editing the template deletespace.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets.

References

For more information

If you have any questions or comments about this advisory:

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-web-templates >= 3.4-milestone-1, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.10.5, 15.1-rc-1

References

CVSS score 9.6/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-79, CWE-87
Platform
Java / Kotlin (Maven)
Package
org.xwiki.platform:xwiki-platform-web-templates
Disclosed
22.06.2023
Updated
11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-x234-mg7q-m8g8 - CC BY 4.0

Vulnerability history: org.xwiki.platform:xwiki-platform-web-templates

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive
Total entries
23
First → latest
02.2022 04.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 10
  • High 4
  • Medium 8
  • Low 1

Disclosures per year

Severity:
  1. In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
    Critical · 9.0 CVE-2024-43401 < 15.10-rc-1 15.10-rc-1
  2. XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
    Critical · 9.0 CVE-2024-41947 >= 11.8-rc-1, < 15.10.8, >= 16.0.0-rc-1, < 16.3.0-rc-1 15.10.8, 16.3.0-rc-1
  3. XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages
    Critical · 9.0 CVE-2023-45137 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  4. XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
    Critical · 9.6 CVE-2023-45136 >= 12.0-rc-1, < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  5. XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
    Critical · 9.0 CVE-2023-45135 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  6. XWiki Platform XSS vulnerability from account in the create page form via template provider
    Critical · 9.0 CVE-2023-45134 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  7. XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
    Critical · 9.6 CVE-2023-35160 >= 2.5-milestone-2, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.10.5, 15.1-rc-1
  8. XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template this entry
    Critical · 9.6 CVE-2023-35159 >= 3.4-milestone-1, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.10.5, 15.1-rc-1
  9. XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
    Critical · 9.0 CVE-2023-34464 < 14.4.8, >= 14.5, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.4.8, 14.10.5, 15.1-rc-1
  10. xwiki-platform-web-templates vulnerable to Eval Injection
    Critical · 9.9 CVE-2023-29512 >= 1.0B1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.1 13.10.11, 14.4.8, 14.10.1
  11. Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
    High · 8.9 CVE-2023-29207 >= 1.9-milestone-2, < 13.10.10, >= 14.0-rc-1, < 14.4.6, >= 14.5, < 14.9 13.10.10, 14.4.6, 14.9
  12. XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor
    High · 7.5 CVE-2022-36091 >= 1.3, < 13.10.4 13.10.4
  13. XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
    High · 8.5 CVE-2022-36093 < 13.10.5, >= 14.0, < 14.3-rc-1 13.10.5, 14.3-rc-1
  14. Cross site scripting in registration template in xwiki-platform
    High · 7.4 CVE-2022-23622 >= 2.6.1, < 12.10.11, >= 13.0.0, < 13.4.7, >= 13.10.0, < 13.10.3 12.10.11, 13.4.7, 13.10.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.