CVE-2023-35157

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-35157
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35157.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-35157
Aliases
Published
2023-06-23T18:22:54.954Z
Modified
2025-12-10T10:09:59.371075Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35157.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f0645cf53274e7ef6c17285a079673573c4e41c2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35157.json"

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
35e9073ffec567861e0abeea072bd97921a3decf

Affected versions

xwiki-application-calendar-1.*

xwiki-application-calendar-1.0

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

xwiki-plugin-tag-1.*

xwiki-plugin-tag-1.1

Database specific

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "83481225452250177847671677846484227863",
                "285335616211195339674611768096891025312",
                "141920702564764743096116803841040566237",
                "76406572421196615171642892192870295284",
                "269610283596011661642063017581082958056",
                "33421014097763673040256300293516599865",
                "221139168121518500036299848564462210887",
                "49820519058838260669941167775266252031"
            ]
        },
        "id": "CVE-2023-35157-430dd3ba",
        "source": "https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "339485555648436523770719602717832158566",
                "21552461369086937123752591441810196877",
                "36582427743792183119567559403235061415",
                "121506160222240759370105368171602899465",
                "265457051591358079651390299459991500691",
                "162468150983638347127964177424029516635",
                "78825691419813220924344806920564526771",
                "249437892511136494279236085016178664183",
                "320589800619026880010579573992573327561",
                "201779335507120924906160915201984098003",
                "335585060081791019643538376190267156839",
                "213896945872756936569417719064108859411",
                "238006012062836187942413460702230217222"
            ]
        },
        "id": "CVE-2023-35157-4f59afc8",
        "source": "https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/AttachmentIT.java"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "86867980800138849816587855056598866398",
                "275694039060616973618431966307549648824",
                "158531316285801763870913461995226043566",
                "46736058658898047529375298455987156575"
            ]
        },
        "id": "CVE-2023-35157-581d9d51",
        "source": "https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "length": 138.0,
            "function_hash": "147765361163687990440836444771858003089"
        },
        "id": "CVE-2023-35157-8af2493c",
        "source": "https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf",
        "signature_type": "Function",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java",
            "function": "localizePlainOrKey"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "length": 415.0,
            "function_hash": "166338131510152566093735534838163962468"
        },
        "id": "CVE-2023-35157-b5e4f75b",
        "source": "https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf",
        "signature_type": "Function",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java",
            "function": "extractListFromReference"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "241078659630100580176171531391402708863",
                "88139829282581434195859422113811257585",
                "185867112840509317092934079532123870826"
            ]
        },
        "id": "CVE-2023-35157-d6c0b2aa",
        "source": "https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/po/BasePage.java"
        },
        "signature_version": "v1",
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35157.json"