Reflected Cross-Site Scripting (XSS) in Error Messages

The /bin/distribution/XWiki/Distribution endpoint was found to be vulnerable to reflected XSS via the extensionId and extensionVersion query parameters. When attacker-supplied values are provided in these parameters, they are reflected unescaped into the resulting error message. As a result, arbitrary JavaScript is executed in the browser of any user who follows a crafted link to this endpoint.

Because the payload is executed when the error message is rendered, this vulnerability can be exploited without requiring the user to upload content or otherwise interact beyond clicking a malicious link.