CVE-2023-29205 : XWiki Commons are technical libraries common to several other top level XWiki pr

XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be particularly dangerous since in a standard wiki, any user is able to use the html macro directly in their own user profile page. The problem has been patched in XWiki 14.8RC1. The patch involves the HTML macros and are systematically cleaned up whenever the user does not have the script correct.

Published 2023-04-15 16:15:07

Updated 2023-04-26 18:37:40

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2023-29205

Xwiki » Xwiki
Versions up to, including, (<=) 14.7
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-29205

EPSS FAQ

2.31%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 84 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-29205

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
9.9	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	3.1	6.0	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-29205

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2023-29205

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxf7-mx22-jr24

Multiple instances of stored cross-site scripting (XSS) via HTML and raw macro · Advisory · xwiki/xwiki-platform · GitHub
Exploit;Patch;Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-18568

[XWIKI-18568] Multiple instances of stored cross-site scripting (XSS) via editor and HTML macro - XWiki.org JIRA
Exploit;Issue Tracking

Jump to

Vulnerability Details : CVE-2023-29205

Products affected by CVE-2023-29205

Exploit prediction scoring system (EPSS) score for CVE-2023-29205

CVSS scores for CVE-2023-29205

CWE ids for CVE-2023-29205

References for CVE-2023-29205