CVE-2023-36471— HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml
Quick assessment
Affected
xwiki xwiki-commons
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
XWiki Commons是法国XWiki基金会的其他几个顶级 XWiki 项目共有的技术库。 XWiki Commons 9.6-rc-1到 14.10.6版本、 15.0-rc-1到 15.2-rc-1版本存在跨站脚本漏洞，该漏洞源于XWiki 中包含的 HTML 清理程序允许表单和输入 HTML 标签，这允许没有脚本权限的攻击者创建可用于网络钓鱼攻击的表单。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1133 · External Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-36471
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml
Source: CVE Program / CVE List V5
Vulnerability Description
Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{groovy}}println("Hello from Groovy!")" />{{/html}}` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document. This has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags. Users are advised to upgrade. As a workaround an admin can manually disallow the tags by adding `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags` in the `xwiki.properties` configuration file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
XWiki Commons 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Commons是法国XWiki基金会的其他几个顶级 XWiki 项目共有的技术库。 XWiki Commons 9.6-rc-1到 14.10.6版本、 15.0-rc-1到 15.2-rc-1版本存在跨站脚本漏洞，该漏洞源于XWiki 中包含的 HTML 清理程序允许表单和输入 HTML 标签，这允许没有脚本权限的攻击者创建可用于网络钓鱼攻击的表单。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-commons | >= 14.6-rc-1, < 14.10.6 | - |
|
II. Public POCs for CVE-2023-36471
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/shoucheng3/xwiki__xwiki-commons_CVE-2023-36471_14-10-5 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-36471
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-36471 (1)
Vendor Advisories for CVE-2023-36471 (1)
-
https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-6pqf-c99p-758v x_refsource_CONFIRM
Other References for CVE-2023-36471 (1)
-
https://jira.xwiki.org/browse/XCOMMONS-2634 x_refsource_MISC
Same Patch Batch · xwiki · 2023-06-29 · 4 CVEs total
| CVE-2023-36468 | 10.0 CRITICAL | Upgrading doesn't prevent exploiting vulnerable XWiki documents |
| CVE-2023-36469 | 10.0 CRITICAL | Code injection through NotificationRSSService in XWiki Platform |
| CVE-2023-36470 | 10.0 CRITICAL | Code injection in icon themes of XWiki Platform |
IV. Related Vulnerabilities
Same product: xwiki-commons
-
CVE-2026-23734
XWiki Platform: Path traversal via resources parameter in ss -
CVE-2024-31996
XWiki Commons missing escaping of `{` in Velocity escapetool -
CVE-2023-31126
Improper Neutralization of Invalid Characters in Data Attrib -
CVE-2023-29528
Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml -
CVE-2023-29201
org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vul
Same vendor: xwiki
-
CVE-2025-53837
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injectio -
CVE-2026-53966
XWiki Platform: Privilege escalation from edit to script rig -
CVE-2026-34151
XWiki Platform: Resource path traversal via /skin/ action en -
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin
Same weakness: CWE-74
-
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal -
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData -
CVE-2026-95832
Reflected unknown field names in the kitty colour control es -
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token l -
CVE-2026-19179
IBM Financial Transaction Manager (FTM) is Impacted by Multi
V. Comments for CVE-2023-36471
No comments yet