CVE-2023-29205— org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro
Quick assessment
Affected
xwiki xwiki-platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
XWiki Commons是其他几个顶级 XWiki 项目共有的技术库。 XWiki Commons 存在跨站脚本漏洞，该漏洞源于 HTML macro 不会对与脚本相关的 html 标记进行适当的中和处理。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1068 · Exploitation for Privilege Escalation T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-29205
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro
Source: CVE Program / CVE List V5
Vulnerability Description
XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be particularly dangerous since in a standard wiki, any user is able to use the html macro directly in their own user profile page. The problem has been patched in XWiki 14.8RC1. The patch involves the HTML macros and are systematically cleaned up whenever the user does not have the script correct.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
XWiki Commons 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Commons是其他几个顶级 XWiki 项目共有的技术库。 XWiki Commons 存在跨站脚本漏洞，该漏洞源于 HTML macro 不会对与脚本相关的 html 标记进行适当的中和处理。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-platform | < 14.8-rc-1 | - |
|
II. Public POCs for CVE-2023-29205
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-29205
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-29205 (1)
-
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxf7-mx22-jr24 x_refsource_CONFIRM
Other References for CVE-2023-29205 (1)
-
https://jira.xwiki.org/browse/XWIKI-18568 x_refsource_MISC
Same Patch Batch · xwiki · 2023-04-15 · 10 CVEs total
| CVE-2023-29210 | 10.0 CRITICAL | org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability |
| CVE-2023-29209 | 10.0 CRITICAL | org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnera |
| CVE-2023-29206 | 9.1 CRITICAL | org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by e |
| CVE-2023-29202 | 9.1 CRITICAL | org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability |
| CVE-2023-29201 | 9.1 CRITICAL | org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability |
| CVE-2023-29207 | 8.9 HIGH | Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro |
| CVE-2023-29208 | 7.5 HIGH | Data leak through deleted documents |
| CVE-2023-29204 | 4.7 MEDIUM | URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-o |
| CVE-2023-29203 | 3.7 LOW | Unauthenticated user can have information about hidden users on subwikis through uorgsugge |
IV. Related Vulnerabilities
Same product: xwiki-platform
-
CVE-2026-53966
XWiki Platform: Privilege escalation from edit to script rig -
CVE-2026-34151
XWiki Platform: Resource path traversal via /skin/ action en -
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w
Same vendor: xwiki
-
CVE-2025-53837
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injectio -
CVE-2026-53966
XWiki Platform: Privilege escalation from edit to script rig -
CVE-2026-34151
XWiki Platform: Resource path traversal via /skin/ action en -
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin
Same weakness: CWE-79
-
CVE-2026-105116
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie -
CVE-2026-105114
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization -
CVE-2026-92767
Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contri -
CVE-2026-104313
WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Refle -
CVE-2026-93889
Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site S
V. Comments for CVE-2023-29205
No comments yet