# CVE-2023-46732: XWiki-Platform - XSS

> Live exploitation tracking for CVE-2023-46732 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-46732

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.7
- **Public exploit available:** Yes
- **Affected products:** XWiki-Platform
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- **Tags:** wiki

## Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit `04e325d57` can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.

## CrowdSec analysis

[CVE-2023-46732](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-46732) is a critical vulnerability affecting XWiki Platform, allowing for reflected cross-site scripting (RXSS) via improper handling of a query parameter in wiki page requests. If a user with sufficient rights is tricked into accessing a crafted URL, an attacker may execute actions on their behalf, potentially resulting in remote code execution, data compromise, or full takeover of the XWiki instance.

CrowdSec has been tracking this vulnerability and its exploits since 20th of May 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2023-46732 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
CrowdSec network telemetry also shows that exploitation of CVE-2023-46732 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Exploitation attempts are observed by targeting URLs containing `/bin/view/main/` with maliciously crafted input.

## Timeline

- 2023-11-06: CVE Published. CVE-2023-46732 is published to NVD.
- 2025-05-20: Rule Released. CrowdSec releases a rule to detect CVE-2023-46732 exploitation attempts against the CrowdSec Network.
- 2025-05-20: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-46732 for the first time.

## References

- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9rc-w3wv-fv62
- https://github.com/xwiki/xwiki-platform/commit/04e325d57d4bcb6ab79bddcafbb19032474c2a55
- https://jira.xwiki.org/browse/XWIKI-21095
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46732.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-46732) follows observed exploitation activity for CVE-2023-46732. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.