QID 994954

Date Published: 2023-08-22

QID 994954: Java (Maven) Security Update for org.xwiki.platform:xwiki-platform-web-templates (GHSA-h8cm-3v5f-rgp6)

Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights).

Successful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.

CVSS V3 rated as Critical - 8.6 severity.

CVSS V2 rated as Medium - 5.4 severity.

Solution

Refer to Github security advisory GHSA-h8cm-3v5f-rgp6 for updates and patch information.

Vendor References

GHSA-h8cm-3v5f-rgp6 - github.com/advisories/GHSA-h8cm-3v5f-rgp6

CVEs related to QID 994954

CVE-2023-40176 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-h8cm-3v5f-rgp6	org.xwiki.platform:xwiki-platform-web-templates		github.com/advisories/GHSA-h8cm-3v5f-rgp6

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].