XWiki Platform affected by click-jacking through CSS injection in comments (xwiki xwiki-platform)
En bref
- Source
- NVD
- EPSS
- EPSS 0.32 % · centile 24 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.
Faiblesses (CWE)
- CWE-1021 — Restriction insuffisante des couches d'interface rendues (clickjacking)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | GitHub_M |
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-74rh-c5rh-88vg — XWiki vulnerable to click-jacking through CSS injection in comments
Références européennes
- ENISA EUVD · EUVD-2026-6694
- GCVE · GCVE-0-2026-26000
Configurations affectées (CPE NVD)
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*< 16.10.13cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 17.0.0 < 17.4.6cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 17.5.0 < 17.9.0
Produits affectés
| Produit | Versions |
|---|---|
| xwiki · xwiki-platform | affected >= 17.5.0, < 17.9.0 ; affected >= 17.0.0-rc-1, < 17.4.6 ; affected < 16.10.13 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |