CVE-2023-29205 CRITICAL

CVE-2023-29205: org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro

Vendor Xwiki
Product xwiki-platform
Weakness CWE-79 · XSS
Published April 15, 2023
Last update February 6, 2025
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be particularly dangerous since in a standard wiki, any user is able to use the html macro directly in their own user profile page. The problem has been patched in XWiki 14.8RC1. The patch involves the HTML macros and are systematically cleaned up whenever the user does not have the script correct.

Key dates

02Disclosure timeline

April 15, 2023 CVE published
February 6, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-3072 Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis CVE-2025-22811 WordPress MT Addons for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2025-53369 Citizen Short Description stored XSS vulnerability through wikitext CVE-2021-21084 Adobe Experience Manager stored cross-site scripting vulnerability in resource resolver factory could lead to arbitrary code execution CVE-2024-38677 WordPress REVIEWS.io plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability