Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in XWiki platform - CVE-2023-45137
Published: October 25, 2023 / Updated: May 5, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary actions with the rights of the user opening a malicious link.
The vulnerability exists due to improper neutralization of script-related HTML tags in a web page in the create document form error message in createinline.vm when handling requests for creating a document that already exists. A remote user can create a non-empty document with attack code in its name and trick the victim into opening a crafted link to execute arbitrary actions with the rights of the user opening a malicious link.
User interaction is required to open the malicious link, and the injected code is taken from the document reference of an existing document.