CVE-2023-29201: org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped <script> and <style>-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like <iframe>. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode. There are no known workarounds apart from upgrading to a version including the fix.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29201?
The severity of CVE-2023-29201 is classified as medium risk due to its potential for script injection.
How do I fix CVE-2023-29201?
To fix CVE-2023-29201, upgrade to a version of XWiki Commons higher than 14.5.
What versions of XWiki are affected by CVE-2023-29201?
CVE-2023-29201 affects XWiki versions from 5.0 to 14.5.
What type of vulnerability is CVE-2023-29201?
CVE-2023-29201 is a vulnerability related to improper input validation that can lead to script injection.
Is XWiki's restricted HTML cleaner effective against CVE-2023-29201?
The restricted HTML cleaner in XWiki is ineffective against CVE-2023-29201 as it fails to escape all relevant attributes.