PT-2023-22203 · Xwiki · Xwiki

Thomas Delafosse · Published 2023-04-12 · Updated 2023-09-29 · CVE-2023-29206

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 14.9-rc-1

Description The issue arises from the lack of checks on the author of a JavaScript xobject or StyleSheet xobject added to a XWiki document. This allowed a user with only Edit Right to create such an object and craft a script that could perform certain operations when executed by a user with appropriate rights.

Recommendations For versions prior to 14.9-rc-1, update to XWiki 14.9-rc-1 or later, which patches the issue by only executing the script if the author of it has Script rights. As a temporary workaround, consider applying the patch and rebuilding and redeploying xwiki-platform-skin-skinx.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-29206

GHSA-CMVG-W72J-7PHX

Affected Products

Xwiki

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29206.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cmvg-w72j-7phx · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19583 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19514 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-9119 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/fe65bc35d5672dd2505b7ac4ec42aec57d500fbb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-29206 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29206 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cmvg-w72j-7phx · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/62237 · Telegram Post