CVE-2023-29205

CVSS V2 None CVSS V3 None

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be particularly dangerous since in a standard wiki, any user is able to use the html macro directly in their own user profile page. The problem has been patched in XWiki 14.8RC1. The patch involves the HTML macros and are systematically cleaned up whenever the user does not have the script correct.

Overview

CVE ID
CVE-2023-29205

Assigner
security-advisories@github.com

Vulnerability Status
Analyzed

Published Version
2023-04-15T16:15:07

Last Modified Date
2023-04-26T18:37:40

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version Start	Version End
cpe:2.3:a:xwiki:xwiki::::::::	1	OR		14.7

References

Reference URL	Reference Tags
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxf7-mx22-jr24
https://jira.xwiki.org/browse/XWIKI-18568

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-29205
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29205

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 04:47:26				Added to TrackCVE
2023-04-17 04:47:27			Weakness Enumeration	new
2023-04-17 14:01:14		2023-04-17T13:12:43	CVE Modified Date	updated
2023-04-17 14:01:14	Received	Awaiting Analysis	Vulnerability Status	updated
2023-04-20 15:00:59	Awaiting Analysis	Undergoing Analysis	Vulnerability Status	updated
2023-04-26 19:01:34		2023-04-26T18:37:40	CVE Modified Date	updated
2023-04-26 19:01:34	Undergoing Analysis	Analyzed	Vulnerability Status	updated
2023-04-26 19:01:37			CPE Information	updated