Skip to content
Fencer Vulns
high 8.9

CVE-2023-29207 json

Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro

published 2023-04-12 3 y ago modified 2026-09-10 1 mo ago also GHSA-6vgh-9r3c-2cxp , EUVD-2023-1217

cvss
8.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including JavaScript. This vulnerability was also exploitable via the Documents Macro that is included since XWiki 3.5M1 and doesn't require script rights, this can be demonstrated with the syntax `{{documents id="example" count="5" actions="false" columns="doc.title, before<script>alert(1)</script>after"/}}`. Therefore, this can also be exploited by users without script right and in comments. With the interaction of a user with more rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.

Patch / fix

  • maven org.xwiki.platform:xwiki-platform-flamingo-skin-resources 13.10.10, 14.4.6, 14.9
  • maven org.xwiki.platform:xwiki-platform-flamingo-skin 13.10.10, 14.4.6, 14.9
  • maven org.xwiki.platform:xwiki-platform-flamingo 13.10.10, 14.4.6, 14.9
  • maven org.xwiki.platform:xwiki-platform-web-templates 13.10.10, 14.4.6, 14.9
  • maven org.xwiki.platform:xwiki-platform-web 13.10.10, 14.4.6, 14.9
  • maven org.xwiki.platform:xwiki-web-standard 13.10.10, 14.4.6, 14.9
  • xwiki xwiki 13.10.10, 14.4.6, 14.9

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

1.39% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6vgh-9r3c-2cxp referenced PoC, tagged "exploit" by a source, unverified
  • jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-15205 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
NVD 3.1 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
GitHub 3.1 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Affected packages

ecosystem package affected fixed in
maven org.xwiki.platform:xwiki-platform-flamingo-skin-resources
>=1.9-milestone-2, <13.10.10
>=14.0-rc-1, <14.4.6
>=14.5, <14.9
13.10.10
14.4.6
14.9
maven org.xwiki.platform:xwiki-platform-flamingo-skin
>=1.9-milestone-2, <13.10.10
>=14.0-rc-1, <14.4.6
>=14.5, <14.9
13.10.10
14.4.6
14.9
maven org.xwiki.platform:xwiki-platform-flamingo
>=1.9-milestone-2, <13.10.10
>=14.0-rc-1, <14.4.6
>=14.5, <14.9
13.10.10
14.4.6
14.9
maven org.xwiki.platform:xwiki-platform-web-templates
>=1.9-milestone-2, <13.10.10
>=14.0-rc-1, <14.4.6
>=14.5, <14.9
13.10.10
14.4.6
14.9
maven org.xwiki.platform:xwiki-platform-web
>=1.9-milestone-2, <13.10.10
>=14.0-rc-1, <14.4.6
>=14.5, <14.9
13.10.10
14.4.6
14.9
maven org.xwiki.platform:xwiki-web-standard
>=1.9-milestone-2, <13.10.10
>=14.0-rc-1, <14.4.6
>=14.5, <14.9
13.10.10
14.4.6
14.9

Affected products

  • xwiki xwiki-platform

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.