Log in Start free

Vulnerability · Published Apr 15, 2023 · Assigned by GitHub_M

CVE-2023-29202org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability

Critical 9.1

In plain English

A critical-severity cross-site scripting in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.4%top 27.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter `content` was set to `true`. This allowed arbitrary HTML and in particular also JavaScript injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of a user with programming rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content and sabotaging the wiki. The issue has been patched in XWiki 14.6 RC1, the content of the feed is now properly cleaned before being displayed. As a workaround, if the RSS macro isn't used in the wiki, the macro can be uninstalled by deleting `WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar`, where `XX` is XWiki's version, in the web application's directory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.xwiki.platform:xwiki-core-rendering-macro-rssno fix listedGHSA-c885-89fw-55qr
Mavenorg.xwiki.platform:xwiki-platform-rendering-macro-rss14.6-rc-1GHSA-c885-89fw-55qr

Affected products (as reported)

VendorProductVersions
xwiki xwiki-platform >= 1.8, <= 3.0.1< 14.6-rc-1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References