CVE-2023-45136— XWiki Platform 跨站脚本漏洞
Public Exploits 1
Nuclei · 1 CVE-2023-45136.yaml [template]
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2023-45136の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
ソース: NVD (National Vulnerability Database)
脆弱性説明
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflected cross-site scripting attack in the page creation form. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation. This has been patched in XWiki 14.10.12 and 15.5-rc-1 by adding appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
XWiki Platform 跨站脚本漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
XWiki Platform是法国XWiki基金会的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 存在安全漏洞，该漏洞源于当根据名称策略（默认情况下禁用）验证文档名称时， XWiki 容易受到反射型跨站脚本攻击。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| xwiki | xwiki-platform | >= 12.0-rc-1, < 14.10.12 | - |
II. CVE-2023-45136の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflected cross-site scripting attack in the page creation form. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45136.yaml | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2023-45136のインテリジェンス情報
请登录查看更多情报信息。
CVE-2023-45136 补丁与修复 (1)
CVE-2023-45136 厂商安全公告 (1)
CVE-2023-45136 其他参考 (1)
- https://jira.xwiki.org/browse/XWIKI-20854x_refsource_MISC
Same Patch Batch · xwiki · 2023-10-25 · 10 CVEs total
| CVE-2023-37913 | 10.0 CRITICAL | org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file |
| CVE-2023-37912 | 10.0 CRITICAL | XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro |
| CVE-2023-37909 | 10.0 CRITICAL | Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet |
| CVE-2023-45137 | 9.1 CRITICAL | XWiki Platform XSS with edit right in the create document form for existing pages |
| CVE-2023-45135 | 9.1 CRITICAL | XWiki users can be tricked to execute scripts as the create page action doesn't display th |
| CVE-2023-45134 | 9.1 CRITICAL | XWiki Platform XSS vulnerability from account in the create page form via template provide |
| CVE-2023-37908 | 9.1 CRITICAL | org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in I |
| CVE-2023-37910 | 8.1 HIGH | org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on At |
| CVE-2023-37911 | 6.5 MEDIUM | org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created doc |
IV. 関連脆弱性
同じ製品: xwiki-platform
- CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w - CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h - CVE-2026-33229
XWiki Platform affected by remote code execution with script - CVE-2026-26000
XWiki Platform affected by click-jacking through CSS injecti - CVE-2026-24128
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Er
同じベンダー: xwiki
- CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w - CVE-2026-23734
XWiki Platform: Path traversal via resources parameter in ss - CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h - CVE-2026-40104
XWiki's REST APIs can list all pages/spaces, leading to unav - CVE-2026-33229
XWiki Platform affected by remote code execution with script
同じ弱点: CWE-79
- CVE-2026-54458
AVideo: Unauthenticated Stored DOM Cross-Site Scripting via - CVE-2026-50183
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in A - CVE-2026-50182
AVideo Has Unauthenticated Reflected XSS via $_GET['search'] - CVE-2026-49279
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in Mes - CVE-2026-45738
Argo CD: Stored XSS in application link annotations enables
V. CVE-2023-45136へのコメント
まだコメントはありません