CVE-2023-32070: Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
Impact
HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax.
Patches This has been patched in XWiki 14.6 RC1.
Workarounds There are no known workarounds apart from upgrading to a fixed version.
References https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1 https://jira.xwiki.org/browse/XRENDERING-663
For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-32070?
CVE-2023-32070 is a vulnerability in XWiki Platform where HTML rendering does not check for dangerous attributes/attribute values, allowing for cross-site scripting (XSS) attacks.
What is the severity of CVE-2023-32070?
CVE-2023-32070 has a severity level of critical.
How does CVE-2023-32070 affect XWiki Platform?
CVE-2023-32070 affects XWiki Platform versions prior to 14.6-rc-1.
How can I fix CVE-2023-32070?
To fix CVE-2023-32070, update XWiki Platform to version 14.6-rc-1 or later.
Where can I find more information about CVE-2023-32070?
More information about CVE-2023-32070 can be found in the following references: [reference links]