Vulnerability Details : CVE-2023-29202
Potential exploit
XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter `content` was set to `true`. This allowed arbitrary HTML and in particular also JavaScript injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of a user with programming rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content and sabotaging the wiki. The issue has been patched in XWiki 14.6 RC1, the content of the feed is now properly cleaned before being displayed. As a workaround, if the RSS macro isn't used in the wiki, the macro can be uninstalled by deleting `WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar`, where `XX` is XWiki's version, in the web application's directory.
Vulnerability category: Cross site scripting (XSS)Execute codeGain privilegeInformation leak
Products affected by CVE-2023-29202
- cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
- cpe:2.3:a:xwiki:xwiki:1.8:-:*:*:*:*:*:*
- cpe:2.3:a:xwiki:xwiki:1.8:rc1:*:*:*:*:*:*
- cpe:2.3:a:xwiki:xwiki:1.8:rc2:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-29202
0.79%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 81 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-29202
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.0
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
2.3
|
6.0
|
NIST | |
9.0
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
2.3
|
6.0
|
GitHub, Inc. |
CWE ids for CVE-2023-29202
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: security-advisories@github.com (Primary)
References for CVE-2023-29202
-
https://jira.xwiki.org/browse/XWIKI-19671
[XWIKI-19671] Stored XSS via the RSS macro - XWiki.org JIRAExploit;Issue Tracking;Vendor Advisory
-
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c885-89fw-55qr
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in org.xwiki.platform:xwiki-platform-rendering-macro-rss · Advisory · xwiki/xwiki-platform · GitHubExploit;Patch;Vendor Advisory
-
https://github.com/xwiki/xwiki-platform/commit/5c7ebe47c2897e92d8f04fe2e15027e84dc3ec03
XWIKI-19671: Filter the feed's content in the RSS macro · xwiki/xwiki-platform@5c7ebe4 · GitHubPatch
Jump to