CVE-2023-34464

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until versions 14.4.8, 14.10.5, and 15.1RC1 of org.xwiki.platform:xwiki-platform-web and any version prior to 14.4.8, 14.10.5, and 15.1.RC1 of org.xwiki.platform:xwiki-platform-web-templates, any user who can edit a document in a wiki like the user profile can create a stored cross-site scripting attack. The attack occurs by putting plain HTML code into that document and then tricking another user to visit that document with the `displaycontent` or `rendercontent` template and plain output syntax. If a user with programming rights is tricked into visiting such a URL, arbitrary actions be performed with this user's rights, impacting the confidentiality, integrity, and availability of the whole XWiki installation. This has been patched in XWiki 14.4.8, 14.10.5 and 15.1RC1 by setting the content type of the response to plain text when the output syntax is not an HTML syntax.

• CWE-79

• https://github.com/xwiki/xwiki-platform/commit/53e8292a31ec70fba5e1d705a4ac443658b9e6dfPatch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp7h-f9f5-x4q7Exploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20290Exploit, Issue Tracking, Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/53e8292a31ec70fba5e1d705a4ac443658b9e6dfPatch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp7h-f9f5-x4q7Exploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20290Exploit, Issue Tracking, Patch, Vendor Advisory

Published

Jun 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34459OpenZeppelin Contracts is a library for smart contract devel…5.9
• CVE-2023-3446Issue summary: Checking excessively long DH keys or paramete…5.3
• CVE-2023-34460Tauri is a framework for building binaries for all major des…9.8
• CVE-2023-34461PyBB is an open source bulletin board. A manual code review …5.4
• CVE-2023-34462Netty is an asynchronous event-driven network application fr…6.5
• CVE-2023-34463DataEase is an open source data visualization analysis tool …8.1
• CVE-2023-34465XWiki Platform is a generic wiki platform. Starting in versi…8.1
• CVE-2023-34466XWiki Platform is a generic wiki platform offering runtime s…4.3
• CVE-2023-34467XWiki Platform is a generic wiki platform. Starting in versi…7.5
• CVE-2023-34468The DBCPConnectionPool and HikariCPConnectionPool Controller…8.8
• CVE-2023-34469 AMI AptioV contains a vulnerability in BIOS where an Attack…4.6
• CVE-2023-3447The Active Directory Integration / LDAP Integration plugin f…7.6