CVE-2023-32070

2023-05-1018:15:10

CWE-83

CWE-79

GitHub_M

web.nvd.nist.gov

xwiki

platform

14.6-rc-1

xss

cross-site scripting

security vulnerability

html rendering

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

37.4%

JSON

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn’t check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

Affected configurations

Nvd

Vulners

Node

xwikirenderingMatch3.0milestone_2

xwikixwikiRange≤14.5

VendorProductVersionCPE
xwikirendering3.0cpe:2.3:a:xwiki:rendering:3.0:milestone_2:*:*:*:*:*:*
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	rendering	3.0	cpe:2.3:a:xwiki:rendering:3.0:milestone_2::::::
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::

CNA Affected

[
  {
    "vendor": "xwiki",
    "product": "xwiki-rendering",
    "versions": [
      {
        "version": "< 14.6-rc-1",
        "status": "affected"
      },
      {
        "version": "<= 3.0-milestone-2",
        "status": "affected"
      }
    ]
  }
]