Sign in
Deutsch English Español Polski
Critical

In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

  • Disclosed: 19.08.2024
  • Updated: 11.10.2026 12:21

Impact

A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time.

Patches

This vulnerability has been patched in XWiki 15.10RC1.

Workarounds

No workaround. It is advised to upgrade to XWiki 15.10+.

References

For more information

If you have any questions or comments about this advisory:

Attribution

This vulnerability has been reported on Intigriti by @floerer

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-web-templates < 15.10-rc-1 15.10-rc-1

References

CVSS score 9/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-269, CWE-862
Platform
Java / Kotlin (Maven)
Package
org.xwiki.platform:xwiki-platform-web-templates
Disclosed
19.08.2024
Updated
11.10.2026 12:21

Sources and licenses

OSV / GitHub Advisory Database - GHSA-f963-4cq8-2gw7 - CC BY 4.0

Vulnerability history: org.xwiki.platform:xwiki-platform-web-templates

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive
Total entries
23
First → latest
02.2022 04.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 10
  • High 4
  • Medium 8
  • Low 1

Disclosures per year

Severity:
  1. In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them this entry
    Critical · 9.0 CVE-2024-43401 < 15.10-rc-1 15.10-rc-1
  2. XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
    Critical · 9.0 CVE-2024-41947 >= 11.8-rc-1, < 15.10.8, >= 16.0.0-rc-1, < 16.3.0-rc-1 15.10.8, 16.3.0-rc-1
  3. XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages
    Critical · 9.0 CVE-2023-45137 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  4. XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
    Critical · 9.6 CVE-2023-45136 >= 12.0-rc-1, < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  5. XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
    Critical · 9.0 CVE-2023-45135 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  6. XWiki Platform XSS vulnerability from account in the create page form via template provider
    Critical · 9.0 CVE-2023-45134 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  7. XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
    Critical · 9.6 CVE-2023-35160 >= 2.5-milestone-2, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.10.5, 15.1-rc-1
  8. XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
    Critical · 9.6 CVE-2023-35159 >= 3.4-milestone-1, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.10.5, 15.1-rc-1
  9. XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
    Critical · 9.0 CVE-2023-34464 < 14.4.8, >= 14.5, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.4.8, 14.10.5, 15.1-rc-1
  10. xwiki-platform-web-templates vulnerable to Eval Injection
    Critical · 9.9 CVE-2023-29512 >= 1.0B1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.1 13.10.11, 14.4.8, 14.10.1
  11. Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
    High · 8.9 CVE-2023-29207 >= 1.9-milestone-2, < 13.10.10, >= 14.0-rc-1, < 14.4.6, >= 14.5, < 14.9 13.10.10, 14.4.6, 14.9
  12. XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor
    High · 7.5 CVE-2022-36091 >= 1.3, < 13.10.4 13.10.4
  13. XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
    High · 8.5 CVE-2022-36093 < 13.10.5, >= 14.0, < 14.3-rc-1 13.10.5, 14.3-rc-1
  14. Cross site scripting in registration template in xwiki-platform
    High · 7.4 CVE-2022-23622 >= 2.6.1, < 12.10.11, >= 13.0.0, < 13.4.7, >= 13.10.0, < 13.10.3 12.10.11, 13.4.7, 13.10.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.