PT-2023-23582

CVE-2023-32070

Published

2023-05-10

Updated

2023-05-17

Description by

CVSS 3.1

9.0

Critical

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.6-rc-1

Description The issue concerns HTML rendering not checking for dangerous attributes or attribute values, allowing cross-site scripting (XSS) attacks via attributes and link URLs in XWiki syntax.

Recommendations For versions prior to 14.6-rc-1, upgrade to version 14.6-rc-1 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTML rendering until a patch is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-83: Improper Neutralization of Script in Attributes in a Web Page

Related identifiers

CVE-2023-32070