{"id":"CVE-2023-29528","aliases":["GHSA-x37v-36wv-6v6h"],"url":"https://o3.security/vulnerability/CVE-2023-29528","summary":"Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml","details":"### Impact\nThe \"restricted\" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this \"restricted\" mode for security is vulnerable to JavaScript injection (\"cross-site scripting\"/XSS). An example are anonymous comments in XWiki where the HTML macro filters HTML using restricted mode:\n\n```html\n{{html}}\n<!--> <Details Open OnToggle=confirm(\"XSS\")>\n{{/html}}\n```\n\nWhen a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance.\n\nNote that while all versions since 4.2-milestone-1 should be vulnerable, only starting with version 14.6-rc-1 the HTML comment is necessary for the attack to succeed due to [another vulnerability](https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m3jr-cvhj-f35j) that has been patched in version 14.6-rc-1.\n\n### Patches\nThis problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`.\n\n### Workarounds\nThere are no known workarounds apart from upgrading to a version including the fix.\n\n### References\n* https://jira.xwiki.org/browse/XCOMMONS-2568\n* https://jira.xwiki.org/browse/XWIKI-20348\n* https://github.com/xwiki/xwiki-commons/commit/8ff1a9d7e5d7b45b690134a537d53dc05cae04ab\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xwiki.org/)\n* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)\n\n### Attribution\n\nThis vulnerability was reported on Intigriti by [ynoof](https://twitter.com/ynoofAssiri) @Ynoof5.\n","published":"2023-04-20T17:08:50.083Z","modified":"2026-08-12T13:34:18.557622Z","cvss":{"score":9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.commons:xwiki-commons-xml","fixedVersion":"14.10"}],"fix":{"url":"https://github.com/xwiki/xwiki-commons/commit/8ff1a9d7e5d7b45b690134a537d53dc05cae04ab","label":"xwiki/xwiki-commons@8ff1a9d"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XCOMMONS-2568"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20348"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29528.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-x37v-36wv-6v6h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29528"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-commons/commit/8ff1a9d7e5d7b45b690134a537d53dc05cae04ab"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-commons"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T13:34:18.557622Z"}}