CVE-2023-46732

Summary

CVE-2023-46732 is a reflected cross-site scripting (RXSS) vulnerability affecting the XWiki Platform. The issue lies in the `rev` parameter, which is used in the content menu without proper escaping. An attacker can exploit this vulnerability by persuading a user to visit a malicious link containing a crafted parameter. Successful exploitation enables the attacker to execute arbitrary actions under the user's privileges, including remote code execution for users with programming rights. This flaw poses a significant threat to the confidentiality, integrity, and availability of XWiki installations. The vulnerability has been addressed in XWiki 15.6 RC1, 15.5.1, and 14.10.14. Users can apply the patch manually, without upgrading or restarting the instance, using commit `04e325d57`. Upgrading to the affected versions or manually applying the patch is strongly recommended. No known workarounds are available for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.