org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting

published 2023-04-12 3 y ago modified 2026-06-17 4 mo ago also GHSA-hmm7-6ph9-8jf2 , EUVD-2023-1326

cvss: 8.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.

Patch / fix

fixed in 2

maven org.xwiki.platform:xwiki-platform-livedata-macro 13.10.11, 14.4.7, 14.10
xwiki xwiki 13.10.11, 14.4.7

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 21 mo ago (2025-02-06)

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hmm7-6ph9-8jf2 referenced PoC, tagged "exploit" by a source, unverified
jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-20312 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	8.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Affected packages

ecosystem	package	affected	fixed in
maven	org.xwiki.platform:xwiki-platform-livedata-macro	>=13.10.10, <13.10.11 >=14.4, <14.4.7 >=14.9, <14.10	13.10.11 14.4.7 14.10

Affected products

xwiki xwiki-platform

Classification

Weakness

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page
CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /xwiki/xwiki-platform/security/advisories/GHSA-hmm7-6ph9-8jf2
exploit, web, vendor-advisory
jira.xwiki.org /browse/XWIKI-20312
exploit, web, issue-tracking, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2023-29508
advisory
github.com /xwiki/xwiki-platform
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary