CVE-2023-45137— XWiki Platform XSS with edit right in the create document form for existing pages
Quick assessment
Affected
xwiki xwiki-platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
XWiki Platform是法国XWiki基金会的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 存在安全漏洞，该漏洞源于存在跨站脚本漏洞。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-45137
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
XWiki Platform XSS with edit right in the create document form for existing pages
Source: CVE Program / CVE List V5
Vulnerability Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in version 3.1-milestone-2 and prior to version 13.4-rc-1, as well as `org.xwiki.platform:xwiki-platform-web-templates` prior to versions 14.10.12 and 15.5-rc-1, are vulnerable to cross-site scripting. When trying to create a document that already exists, XWiki displays an error message in the form for creating it. Due to missing escaping, this error message is vulnerable to raw HTML injection and thus XSS. The injected code is the document reference of the existing document so this requires that the attacker first creates a non-empty document whose name contains the attack code. This has been patched in `org.xwiki.platform:xwiki-platform-web` version 13.4-rc-1 and `org.xwiki.platform:xwiki-platform-web-templates` versions 14.10.12 and 15.5-rc-1 by adding the appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
XWiki Platform 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Platform是法国XWiki基金会的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 存在安全漏洞，该漏洞源于存在跨站脚本漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-platform | >= 3.1-milestone-2, < 13.4-rc-1 | - |
|
II. Public POCs for CVE-2023-45137
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-45137
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-45137 (1)
Vendor Advisories for CVE-2023-45137 (1)
-
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-93gh-jgjj-r929 x_refsource_CONFIRM
Other References for CVE-2023-45137 (1)
-
https://jira.xwiki.org/browse/XWIKI-20961 x_refsource_MISC
Same Patch Batch · xwiki · 2023-10-25 · 10 CVEs total
| CVE-2023-37913 | 10.0 CRITICAL | org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file |
| CVE-2023-37912 | 10.0 CRITICAL | XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro |
| CVE-2023-37909 | 10.0 CRITICAL | Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet |
| CVE-2023-45136 | 9.7 CRITICAL | XWiki Platform web templates vulnerable to reflected XSS in the create document form if na |
| CVE-2023-45135 | 9.1 CRITICAL | XWiki users can be tricked to execute scripts as the create page action doesn't display th |
| CVE-2023-45134 | 9.1 CRITICAL | XWiki Platform XSS vulnerability from account in the create page form via template provide |
| CVE-2023-37908 | 9.1 CRITICAL | org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in I |
| CVE-2023-37910 | 8.1 HIGH | org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on At |
| CVE-2023-37911 | 6.5 MEDIUM | org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created doc |
IV. Related Vulnerabilities
Same product: xwiki-platform
-
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w -
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h -
CVE-2026-33229
XWiki Platform affected by remote code execution with script
Same vendor: xwiki
-
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w -
CVE-2026-23734
XWiki Platform: Path traversal via resources parameter in ss -
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h
Same weakness: CWE-79
-
CVE-2026-15917
Drupal core - Moderately critical - Cross-site scripting - S -
CVE-2026-55805
Drupal core - Moderately critical - Cross-site scripting - S -
CVE-2026-16638
Media Folders - Moderately critical - Cross site scripting - -
CVE-2026-16640
Search API Autocomplete - Moderately critical - Cross-site S -
CVE-2026-79793
code-projects Online Shopping System sumit_form.php cross si
V. Comments for CVE-2023-45137
No comments yet