CVE-2023-32071

    Dashboard / Vulnerabilities / CVE-2023-32071

    CVE-2023-32071

    Published: 9 May 2023Last Modified: 12 Aug 2026

    Summary: XWiki Platform vulnerable to RXSS via editor parameter - importinline template

    Details: XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.

    References: https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYK, https://jira.xwiki.org/browse/XWIKI-20340, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32071.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfm, https://nvd.nist.gov/vuln/detail/CVE-2023-32071, https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -48ee3193230753aecf8a86d7c8ff3e8f869e8330

    Affected versions

    2.2-milestone1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-32071 | CVE-DB