{"id":"CVE-2023-35157","summary":"XWiki Platform vulnerable to reflected cross-site scripting via delattachment action","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.","aliases":["GHSA-phwm-87rg-27qq"],"modified":"2026-08-12T14:51:06.044522Z","published":"2023-06-23T18:22:54.954Z","database_specific":{"cwe_ids":["CWE-79","CWE-80"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35157.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20339"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35157.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35157"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"f0645cf53274e7ef6c17285a079673573c4e41c2"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"last_affected":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"14.10.6"},{"introduced":"15.0"},{"last_affected":"15.0"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"fixed":"db1b7950037774552be2897571c2e1c5a7589400"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"35e9073ffec567861e0abeea072bd97921a3decf"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"14.10.6"},{"introduced":"15.0"},{"last_affected":"15.0"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["15.0","xwiki-commons-14.10.5","xwiki-commons-14.10.4","xwiki-commons-15.0","xwiki-commons-14.10.3","xwiki-commons-14.10.2","xwiki-commons-14.10.1","xwiki-commons-14.10","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-14.10.5","xwiki-platform-14.10.4","xwiki-platform-14.10.3","xwiki-platform-14.10.2","xwiki-platform-14.10.1","xwiki-platform-14.10","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"vanir_signatures_modified":"2026-08-12T14:51:06Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java"},"deprecated":false,"digest":{"line_hashes":["83481225452250177847671677846484227863","285335616211195339674611768096891025312","141920702564764743096116803841040566237","76406572421196615171642892192870295284","269610283596011661642063017581082958056","33421014097763673040256300293516599865","221139168121518500036299848564462210887","49820519058838260669941167775266252031"],"threshold":0.9},"id":"CVE-2023-35157-430dd3ba","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["339485555648436523770719602717832158566","21552461369086937123752591441810196877","36582427743792183119567559403235061415","121506160222240759370105368171602899465","265457051591358079651390299459991500691","162468150983638347127964177424029516635","78825691419813220924344806920564526771","249437892511136494279236085016178664183","320589800619026880010579573992573327561","201779335507120924906160915201984098003","335585060081791019643538376190267156839","213896945872756936569417719064108859411","238006012062836187942413460702230217222"],"threshold":0.9},"id":"CVE-2023-35157-4f59afc8","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf","target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/AttachmentIT.java"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf","target":{"file":"xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java"},"deprecated":false,"digest":{"line_hashes":["86867980800138849816587855056598866398","275694039060616973618431966307549648824","158531316285801763870913461995226043566","46736058658898047529375298455987156575"],"threshold":0.9},"id":"CVE-2023-35157-581d9d51","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"147765361163687990440836444771858003089","length":138},"id":"CVE-2023-35157-8af2493c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java","function":"localizePlainOrKey"}},{"id":"CVE-2023-35157-b5e4f75b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf","target":{"file":"xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java","function":"extractListFromReference"},"deprecated":false,"digest":{"function_hash":"166338131510152566093735534838163962468","length":415}},{"id":"CVE-2023-35157-d6c0b2aa","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf","target":{"file":"xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/po/BasePage.java"},"deprecated":false,"digest":{"line_hashes":["241078659630100580176171531391402708863","88139829282581434195859422113811257585","185867112840509317092934079532123870826"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35157.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"}]}