CVE-2023-32070

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

Published: May 10, 2023
Updated: May 10, 2024
CVE: CVE-2023-32070
GHSA: GHSA-6gf5-c898-7rxp
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWEs:

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
org.xwiki.rendering / xwiki-rendering-syntax-xhtml	-	14.6-rc-1
org.xwiki.platform / xwiki-core-rendering-api	-	3.0-milestone-2.x
org.xwiki.rendering / xwiki-rendering-syntax-html	-	14.6-rc-1
org.xwiki.rendering / xwiki-rendering-syntax-html5	-	14.6-rc-1
org.xwiki.rendering / xwiki-rendering-syntax-annotatedxhtml	-	14.6-rc-1
org.xwiki.rendering / xwiki-rendering-syntax-annotatedhtml5	-	14.6-rc-1
org.xwiki.platform / xwiki-platform-annotation-core	-	14.6-rc-1
xwiki / xwiki	-	14.5.x
xwiki / rendering	3.0-milestone_2	3.0-milestone_2.x

Vulnerability Database

CVE-2023-32070

Deep Security Visibility Without the Complexity