Executive Summary

The vulnerability exists in the XWiki blog application versions prior to 9.15.7. It is a Stored Cross-Site Scripting (XSS) issue that occurs because the blog post title is inserted directly into the HTML <title> tag without proper escaping.

An attacker who has permission to create or edit blog posts can inject malicious JavaScript code into the title field. This malicious script will then execute in the browsers of any users who view the blog post, including administrators.

This can lead to session hijacking or privilege escalation. The vulnerability was fixed in version 9.15.7 by adding the missing escaping to the title field.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to execute malicious JavaScript in the browsers of users who view the affected blog posts.

Such script execution can lead to session hijacking, where attackers steal user session tokens, or privilege escalation, where attackers gain higher access rights than intended.

This can compromise user accounts, including administrator accounts, potentially leading to unauthorized access and control over the XWiki platform.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been patched in the XWiki blog application version 9.15.7 by adding missing escaping to the blog post title.

To mitigate this vulnerability, you should immediately upgrade the XWiki blog application to version 9.15.7 or later.

No known workarounds are available.

Useful 0 Not Useful 0