PT-2023-23582

CVE-2023-32070

Publicado

2023-05-10

Atualizado

2023-05-17

Descrição por

CVSS 3.1

9.0

Crítica

MétricasAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.6-rc-1

Description The issue concerns HTML rendering not checking for dangerous attributes or attribute values, allowing cross-site scripting (XSS) attacks via attributes and link URLs in XWiki syntax.

Recommendations For versions prior to 14.6-rc-1, upgrade to version 14.6-rc-1 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTML rendering until a patch is applied.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-83: Improper Neutralization of Script in Attributes in a Web Page

Identificadores relacionados

CVE-2023-32070