Vulnerability · Published Apr 16, 2023 · Assigned by GitHub_M
CVE-2023-29508org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting
High 8.9
In plain English
A high-severity cross-site scripting in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.9High
Exploit odds (30 days)0.4%top 63.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-livedata-macro | 13.10.11 | GHSA-hmm7-6ph9-8jf2 |
| Maven | org.xwiki.platform:xwiki-platform-livedata-macro | 14.4.7 | GHSA-hmm7-6ph9-8jf2 |
| Maven | org.xwiki.platform:xwiki-platform-livedata-macro | 14.10 | GHSA-hmm7-6ph9-8jf2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 13.10.10, < 13.10.11>= 14.4, < 14.4.7>= 14.9, < 14.10 |
Weakness: CWE-80, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hmm7-6ph9-8jf2 x_refsource_CONFIRM
- https://jira.xwiki.org/browse/XWIKI-20312 x_refsource_MISC