PT-2023-22198 · Xwiki · Xwiki Commons

Thomas Delafosse · Published 2023-04-12 · Updated 2026-05-26 · CVE-2023-29201

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Commons versions 4.2-milestone-1 through 14.6 RC1

Description The "restricted" mode of the HTML cleaner in XWiki only escaped <script> and <style>-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like <iframe>. This allows for JavaScript injection, also known as cross-site scripting (XSS), when a privileged user with programming rights visits a comment in XWiki containing malicious JavaScript code. The code is executed in the context of the user session, impacting the confidentiality, integrity, and availability of the XWiki instance.

Recommendations For XWiki Commons versions 4.2-milestone-1 through 14.6 RC1, upgrade to XWiki 14.6 RC1 or later, which includes a patch with a filter that allows only specific HTML elements and attributes in restricted mode. As a temporary workaround, consider disabling the HTML macro that filters HTML using restricted mode until a patch is available. Restrict access to comments and other areas where the HTML macro is used to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-29201

GHSA-M3JR-CVHJ-F35J

Affected Products

Xwiki Commons

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29201.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m3jr-cvhj-f35j · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-9118 · Exploit
• 🔥 https://jira.xwiki.org/browse/XCOMMONS-1680 · Exploit
• 🔥 https://jira.xwiki.org/browse/XCOMMONS-2426 · Exploit
• https://github.com/xwiki/xwiki-commons/commit/4a185e0594d90cd4916d60aa60bb4333dc5623b2 · Patch
• https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-29201 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29201 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m3jr-cvhj-f35j · Vendor Advisory
• https://github.com/xwiki/xwiki-commons · Note
• https://twitter.com/TrentAIHQ/status/2059267067182973128 · Twitter Post