CVE-2023-35157

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

• CWE-79
• CWE-80
• CWE-79

• https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decfPatch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qqVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20339Issue Tracking, Permissions Required, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decfPatch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qqVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20339Issue Tracking, Permissions Required, Vendor Advisory

Published

Jun 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35151XWiki Platform is a generic wiki platform. Starting in versi…7.5
• CVE-2023-35152XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-35153XWiki Platform is a generic wiki platform. Starting in versi…5.4
• CVE-2023-35154Knowage is an open source analytics and business intelligenc…6.5
• CVE-2023-35155XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-35156XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-35158XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-35159XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-35160XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-35161XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-35162XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-35163Vega is a decentralized trading platform that allows pseudo-…5.2