PT-2023-22199 · Xwiki · Xwiki

Michael Hamann · Published 2023-04-12 · Updated 2023-04-25 · CVE-2023-29202

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 14.6 RC1

Description The RSS macro in XWiki included the content of feed items without proper cleaning in the HTML output when the parameter content was set to true, allowing arbitrary HTML and JavaScript injection, and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. This could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content, and sabotaging the wiki, with the interaction of a user with programming rights.

Recommendations For versions prior to 14.6 RC1, update to XWiki 14.6 RC1, where the content of the feed is now properly cleaned before being displayed. As a workaround, if the RSS macro isn't used in the wiki, consider uninstalling the macro by deleting WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar, where XX is XWiki's version, in the web application's directory.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-29202

GHSA-C885-89FW-55QR

Affected Products

Xwiki

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29202.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c885-89fw-55qr · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19671 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/5c7ebe47c2897e92d8f04fe2e15027e84dc3ec03 · Patch
• https://osv.dev/vulnerability/GHSA-c885-89fw-55qr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29202 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29202 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/48339 · Telegram Post