XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.
References
Link | Resource |
---|---|
https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1 | Patch |
https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp | Patch Vendor Advisory |
https://jira.xwiki.org/browse/XRENDERING-663 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
17 May 2023, 20:12
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-79 | |
CPE | cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* cpe:2.3:a:xwiki:rendering:3.0:milestone_2:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
References | (MISC) https://jira.xwiki.org/browse/XRENDERING-663 - Vendor Advisory | |
References | (MISC) https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1 - Patch | |
References | (MISC) https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp - Patch, Vendor Advisory |
10 May 2023, 18:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-05-10 18:15
Updated : 2024-02-04 23:37
NVD link : CVE-2023-32070
Mitre link : CVE-2023-32070
CVE.ORG link : CVE-2023-32070
JSON object : View
Products Affected
xwiki
- rendering
- xwiki