CVE-2023-29201— org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability
Quick assessment
Affected
xwiki xwiki-commons
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
XWiki Commons是法国XWiki基金会的其他几个顶级 XWiki 项目共有的技术库。 XWiki Commons 4.2-milestone-1版本存在跨站脚本漏洞，该漏洞源于 不转义可用于注入脚本的属性，也不转义其他危险的HTML标签。攻击者利用该漏洞执行恶意代码。
Possible ATT&CK Techniques 3 AI
T1505 · Server Software Component T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-29201
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `<script>` and `<style>`-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like `<iframe>`. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode. There are no known workarounds apart from upgrading to a version including the fix.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
XWiki Commons 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Commons是法国XWiki基金会的其他几个顶级 XWiki 项目共有的技术库。 XWiki Commons 4.2-milestone-1版本存在跨站脚本漏洞，该漏洞源于 不转义可用于注入脚本的属性，也不转义其他危险的HTML标签。攻击者利用该漏洞执行恶意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-commons | >= 4.2-milestone-1, < 14.6-rc-1 | - |
|
II. Public POCs for CVE-2023-29201
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/shoucheng3/xwiki__xwiki-commons_CVE-2023-29201_14-5 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-29201
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-29201 (2)
Vendor Advisories for CVE-2023-29201 (1)
-
https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m3jr-cvhj-f35j x_refsource_CONFIRM
Other References for CVE-2023-29201 (3)
-
https://jira.xwiki.org/browse/XWIKI-9118 x_refsource_MISC
-
https://jira.xwiki.org/browse/XCOMMONS-2426 x_refsource_MISC
-
https://jira.xwiki.org/browse/XCOMMONS-1680 x_refsource_MISC
Same Patch Batch · xwiki · 2023-04-15 · 10 CVEs total
| CVE-2023-29210 | 10.0 CRITICAL | org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability |
| CVE-2023-29209 | 10.0 CRITICAL | org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnera |
| CVE-2023-29205 | 10.0 CRITICAL | org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scriptin |
| CVE-2023-29206 | 9.1 CRITICAL | org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by e |
| CVE-2023-29202 | 9.1 CRITICAL | org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability |
| CVE-2023-29207 | 8.9 HIGH | Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro |
| CVE-2023-29208 | 7.5 HIGH | Data leak through deleted documents |
| CVE-2023-29204 | 4.7 MEDIUM | URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-o |
| CVE-2023-29203 | 3.7 LOW | Unauthenticated user can have information about hidden users on subwikis through uorgsugge |
IV. Related Vulnerabilities
Same product: xwiki-commons
-
CVE-2026-23734
XWiki Platform: Path traversal via resources parameter in ss -
CVE-2024-31996
XWiki Commons missing escaping of `{` in Velocity escapetool -
CVE-2023-36471
HTML sanitizer allows form elements in restricted in org.xwi -
CVE-2023-31126
Improper Neutralization of Invalid Characters in Data Attrib -
CVE-2023-29528
Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
Same vendor: xwiki
-
CVE-2025-53837
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injectio -
CVE-2026-53966
XWiki Platform: Privilege escalation from edit to script rig -
CVE-2026-34151
XWiki Platform: Resource path traversal via /skin/ action en -
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin
Same weakness: CWE-79
-
CVE-2026-92767
Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contri -
CVE-2026-104313
WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Refle -
CVE-2026-93889
Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site S -
CVE-2026-93896
WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scr -
CVE-2026-92974
Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scri
V. Comments for CVE-2023-29201
Anonymous User
2025-08-25 09:40:15katana