Skip to content
Fencer Vulns
critical 9.1

CVE-2023-36471 json

HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml

published 2023-06-29 3 y ago modified 2026-09-10 1 mo ago also GHSA-6pqf-c99p-758v , EUVD-2023-1714

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{groovy}}println(&quot;Hello from Groovy!&quot;)" />{{/html}}` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document. This has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags. Users are advised to upgrade. As a workaround an admin can manually disallow the tags by adding `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags` in the `xwiki.properties` configuration file.

Patch / fix

  • maven org.xwiki.commons:xwiki-commons-xml 14.10.6, 15.2-rc-1
  • xwiki commons 14.10.6

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
23 mo ago

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • jira.xwiki.org https://jira.xwiki.org/browse/XCOMMONS-2634 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-6pqf-c99p-758v referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.xwiki.commons:xwiki-commons-xml
>=14.6-rc-1, <14.10.6
>=15.0-rc-1, <15.2-rc-1
14.10.6
15.2-rc-1

Affected products

  • xwiki xwiki-commons

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.