Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in XWiki platform - CVE-2023-45137

Detailed vulnerability description

The vulnerability allows a remote user to execute arbitrary actions with the rights of the user opening a malicious link.

The vulnerability exists due to improper neutralization of script-related HTML tags in a web page in the create document form error message in createinline.vm when handling requests for creating a document that already exists. A remote user can create a non-empty document with attack code in its name and trick the victim into opening a crafted link to execute arbitrary actions with the rights of the user opening a malicious link.

User interaction is required to open the malicious link, and the injected code is taken from the document reference of an existing document.

How to mitigate CVE-2023-45137

Sources

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-93gh-jgjj-r929
• https://github.com/xwiki/xwiki-platform/commit/ed8ec747967f8a16434806e727a57214a8843581