CVE-2023-29528criticalCWE-79

CVE-2023-29528: critical vulnerability in xwiki-commons

Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml

Published · Updated

Follow this CVE+ Monitor xwiki-commons+ Monitor org.xwiki.commons:xwiki-commons-xml

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.1epss 1.3%
from disclosure to weapon853 days
Published on NVDApr 20
1st PoC+853d
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
xwiki · xwiki-commons
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — xwiki-commons

In the same product, most dangerous first.

CVE-2026-23734CRITICALXWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slashEPSS 18.5%CVE-2024-31996CRITICALXWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionEPSS 2.1%CVE-2022-24897HIGHArbitrary filesystem write access from VelocityEPSS 1.8%CVE-2022-24898MEDIUMArbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xmlEPSS 1.5%CVE-2023-26055CRITICALXWiki Commons may allow privilege escalation to programming rights via user's first nameEPSS 1.2%CVE-2023-29201CRITICALorg.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityEPSS 1.2%