Executive brief
XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer
Affected products
- Maven org.xwiki.platform:xwiki-platform-web-templates
Junglewise Threat Intelligence
CVE-2023-40176: XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer
CVE-2023-40176 · Severity: low · CVSS 3.1 · Published 2023-08-21
Technologies: org.xwiki.platform:xwiki-platform-web-templates (Maven). Vendors: Maven.
Related threats
- In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
- xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
- XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor