CVE-2023-32071

XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.

• CWE-79
• CWE-116
• CWE-79

• https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYKPermissions Required
• https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfmVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20340Vendor Advisory
• https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYKPermissions Required
• https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfmVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20340Vendor Advisory

Published

May 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32066Time Tracker is an open source time tracking system. The wee…5.4
• CVE-2023-32067c-ares is an asynchronous resolver library. c-ares is vulner…7.5
• CVE-2023-32068XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-32069XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-3207Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-32070XWiki Platform is a generic wiki platform. Prior to version …6.1
• CVE-2023-32072Tuleap is an open source tool for end to end traceability of…4.8
• CVE-2023-32073WWBN AVideo is an open source video platform. In versions 12…8.8
• CVE-2023-32074user_oidc app is an OpenID Connect user backend for Nextclou…9.8
• CVE-2023-32075The Customer Management Framework (CMF) for Pimcore adds fun…4.3
• CVE-2023-32076in-toto is a framework to protect supply chain integrity. Th…5.5
• CVE-2023-32077Netmaker makes networks with WireGuard. Prior to versions 0.…7.5