CVE-2023-35153: XWiki Platform AppWithinMinutes Stored Cross-Site Scripting Vulnerability

org.xwiki.platform:xwiki-platform-appwithinminutes-ui Updated 02 Oct 2025

Summary

20/06/2023

Disclosed on

CVE-2023-35153

CVE

Yes i

Fix available

Critical

Severity

9.0

CVSS Score

CVE-2023-35153: XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters. Affects org.xwiki.platform:xwiki-platform-appwithinminutes-ui across 3 version ranges.

>= 5.4.4, < 14.4.8 >= 14.5, < 14.10.4 >= 15.0-rc-1, < 15.0

Fixed in 14.4.8, 14.10.4 or 15.0, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

XWiki Platform is an open-source wiki software written in Java that allows users to create and collaborate on content. The AppWithinMinutes module provides a way to create custom applications within XWiki. It includes features such as form fields, categories, and templates. The XWiki Platform AppWithinMinutes UI package is responsible for the user interface of the module.

Vulnerability Detail

The XWiki Platform AppWithinMinutes UI package is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability allows users with edit rights to inject malicious scripts into the ClassEditSheet page via the 'name' parameter. By adding a specific class and setting the payload on the page title, an attacker can execute arbitrary code when other users visit the '/xwiki/bin/view/AppWithinMinutes/ClassEditSheet' page. This can lead to unauthorized access, data theft, or other malicious activities.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

>= 5.4.4, < 14.4.8 14.4.8
>= 14.5, < 14.10.4 14.10.4
>= 15.0-rc-1, < 15.0 15.0

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If updating the XWiki Platform AppWithinMinutes UI package is not immediately feasible, you can apply a temporary workaround by manually patching the 'AppWithinMinutes.ClassEditSheet' file. The patch can be found in the following GitHub commit: link to patch. Follow the instructions provided in the commit to apply the patch to your installation. However, it is strongly recommended to update to the latest version of the package as soon as possible.

Conclusion

The XWiki Platform AppWithinMinutes UI package is vulnerable to a stored cross-site scripting (XSS) attack. To mitigate this vulnerability, it is crucial to update the package to the recommended versions or apply the provided patch. Regularly monitoring for security updates and promptly applying them is essential to ensure the security of your XWiki installation. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.xwiki.platform:xwiki-platform-appwithinminutes-ui →