CVE-2023-29201 org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability
Insufficient HTML sanitization in restricted mode allows XSS, enabling server-side code execution when privileged users view malicious comments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-29201?
CVE-2023-29201 is a critical cross-site scripting vulnerability in Xwiki Xwiki, published on 15 Apr 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `<script>` and `<style>`-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like `<iframe>`. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode. There are no known workarounds apart from upgrading to a version including the fix.
Weakness: CWE-79
Which versions are affected by CVE-2023-29201?
2 open source packages ship an affected version, including org.xwiki.commons:xwiki-commons-xml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.xwiki.commons:xwiki-commons-xml Maven | From 4.2-milestone-1 | 14.6-rc-1 |
org.xwiki.commons:xwiki-commons-xml Maven | From 4.2-milestone-1 | 14.6-rc-1 |
Products include Xwiki Xwiki.
How do I fix CVE-2023-29201?
Upgrade org.xwiki.commons:xwiki-commons-xml to 14.6-rc-1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-29201 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-29201 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Xwiki Xwiki
- CVE-2025-24893 XWiki Platform Eval Injection
- CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros
- CVE-2024-55662 XWiki allows remote code execution through the extension sheet
- CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
- CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
Sources
Also known as GHSA-m3jr-cvhj-f35j.