CVE-2023-29206

Katalog CVE

CVSS 5.4 · Medium EPSS 0,95%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada xwiki. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script allowing to perform some operations when executing by a user with appropriate rights. This has been patched in XWiki 14.9-rc-1 by only executing the script if the author of it has Script rights.

Rincian

Terbit di NVD

15 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cmvg-w72j-7phx exploit · patch · advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/fe65bc35d5672dd2505b7ac4ec42aec57d500fbb patch
• https://jira.xwiki.org/browse/XWIKI-19514 exploit · issue tracking
• https://jira.xwiki.org/browse/XWIKI-19583 exploit · issue tracking
• https://jira.xwiki.org/browse/XWIKI-9119 exploit · issue tracking · permissions required