CVE-2023-40176criticalCWE-79

CVE-2023-40176: critical vulnerability in xwiki-platform

SXSS in the user profile via the timezone displayer

Published · Updated

Follow this CVE+ Monitor xwiki-platform+ Monitor org.xwiki.platform:xwiki-platform-web-templates

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 80%
In short

A user can inject malicious code into their profile's timezone field, which then executes when other users view that profile. This allows attackers to steal information or gain unauthorized access to the system.

Technical detail

Stored XSS vulnerability in XWiki Platform's user profile timezone preference allows authenticated users to bypass the dropdown UI restriction via JavaScript or direct URL manipulation to inject arbitrary payloads. The unescaped timezone display triggers client-side code execution for any visitor of the malicious profile, enabling session hijacking, credential theft, and privilege escalation to programming rights.

Summary generated and translated by AI from the official description.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights). This issue is present since version 4.1M2 when the time zone user preference was introduced. The issue has been fixed in XWiki 14.10.5 and 15.1RC1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
xwiki · xwiki-platform
Related CVEs — xwiki-platform

In the same product, most dangerous first.

CVE-2025-24893CRITICALRemote code execution as guest via SolrSearchMacros request in xwikiEPSS 100.0%KEVCVE-2024-21650CRITICALXWiki Remote Code Execution vulnerability via user registrationEPSS 93.5%CVE-2023-37462CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiEPSS 91.6%CVE-2023-46731CRITICALRemote code execution through the section parameter in Administration as guest in XWiki PlatformEPSS 88.5%CVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 85.5%CVE-2023-50719HIGHXWiki Platform Solr search discloses password hashes of all usersEPSS 83.5%