PT-2023-8608 · Xwiki · Xwiki

Ynoof · Published 2023-04-20 · Updated 2023-05-01 · CVE-2023-29528

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions 4.2-milestone-1 through 14.10

Description The issue concerns the "restricted" mode of the HTML cleaner in XWiki, which allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. This vulnerability enables server-side code execution with programming rights, impacting the confidentiality, integrity, and availability of the XWiki instance. When a privileged user with programming rights visits a malicious comment, the JavaScript code is executed in the context of the user session.

Recommendations For versions prior to 14.10, upgrade to XWiki 14.10 or later, as it includes the fix where HTML comments are removed in restricted mode and a check is introduced to ensure comments don't start with >. At the moment, there is no other information about additional workarounds apart from upgrading to a version including the fix.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-01261

CVE-2023-29528

GHSA-X37V-36WV-6V6H

Affected Products

Xwiki

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29528.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20348 · Exploit
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-x37v-36wv-6v6h · Vendor Advisory
• https://github.com/xwiki/xwiki-commons/commit/8ff1a9d7e5d7b45b690134a537d53dc05cae04ab · Patch
• https://osv.dev/vulnerability/CVE-2023-29528 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29528 · Security Note
• https://jira.xwiki.org/browse/XCOMMONS-2568 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01261 · Security Note
• https://osv.dev/vulnerability/GHSA-x37v-36wv-6v6h · Vendor Advisory
• https://github.com/xwiki/xwiki-commons · Note
• https://t.me/cibsecurity/62547 · Telegram Post
• https://t.me/cvenotify/49506 · Telegram Post