CVE-2023-40176

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights). This issue is present since version 4.1M2 when the time zone user preference was introduced. The issue has been fixed in XWiki 14.10.5 and 15.1RC1.

• CWE-79

• https://github.com/xwiki/xwiki-platform/commit/d11ca5d781f8a42a85bc98eb82306c1431e764d4Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h8cm-3v5f-rgp6Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-7847Issue Tracking, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/d11ca5d781f8a42a85bc98eb82306c1431e764d4Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h8cm-3v5f-rgp6Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-7847Issue Tracking, Vendor Advisory

Published

Aug 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40170jupyter-server is the backend for Jupyter web applications. …6.1
• CVE-2023-40171Dispatch is an open source security incident management tool…7.5
• CVE-2023-40172Social media skeleton is an uncompleted/framework social med…8.8
• CVE-2023-40173Social media skeleton is an uncompleted/framework social med…7.5
• CVE-2023-40174Social media skeleton is an uncompleted/framework social med…9.8
• CVE-2023-40175Puma is a Ruby/Rack web server built for parallelism. Prior …9.8
• CVE-2023-40177XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-40178Node-SAML is a SAML library not dependent on any frameworks …5.3
• CVE-2023-40179Silverware Games is a premium social network where people ca…5.3
• CVE-2023-4018An issue has been discovered in GitLab affecting all version…5.3
• CVE-2023-40180 silverstripe-graphql is a package which serves Silverstripe…7.5
• CVE-2023-40181FreeRDP is a free implementation of the Remote Desktop Proto…9.1