Maven/org.xwiki.platform:xwiki-platform-web CVE-2023-45135: critical 9, EPSS 1.91%
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
Action: Upgrade org.xwiki.platform:xwiki-platform-web to 14.10.12 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.2-milestone-2 | 14.10.12 | - |
Fixed versions
| 14.10.12 |
Sources
- osv: GHSA-ghf6-2f42-mjh9#Maven/org.xwiki.platform:xwiki-platform-web
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghf6-2f42-mjh9
- https://nvd.nist.gov/vuln/detail/CVE-2023-45135
- https://github.com/xwiki/xwiki-platform/commit/199e27ce7016757e66fa7cea99e718044a1b639b
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-20869
CVE-2023-45135 · published · modified · JSON