{"id":"CVE-2023-29201","summary":"org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability","details":"XWiki Commons are technical libraries common to several other top level XWiki projects. The \"restricted\" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `\u003cscript\u003e` and `\u003cstyle\u003e`-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like `\u003ciframe\u003e`. As a consequence, any code relying on this \"restricted\" mode for security is vulnerable to JavaScript injection (\"cross-site scripting\"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode. There are no known workarounds apart from upgrading to a version including the fix.","aliases":["GHSA-m3jr-cvhj-f35j"],"modified":"2026-08-12T14:50:41.368498Z","published":"2023-04-15T14:24:59.250Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29201.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XCOMMONS-1680"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XCOMMONS-2426"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-9118"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29201.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m3jr-cvhj-f35j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29201"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-commons/commit/4a185e0594d90cd4916d60aa60bb4333dc5623b2"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"dc5230e69b18da6030585a398aa722c7ebebaff1"},{"fixed":"4a185e0594d90cd4916d60aa60bb4333dc5623b2"},{"fixed":"b11eae9d82cb53f32962056b5faa73f3720c6182"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.0"},{"last_affected":"14.5"}],"source":["CPE_RANGE","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"e20ad8657a7859e0cc4c7e86d360fa494ede584c"},{"last_affected":"ab4dfeaeef13360eebcaa507bc652073aa89a427"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.0"},{"last_affected":"14.5"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29201.json","vanir_signatures_modified":"2026-08-12T14:50:41Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182","target":{"file":"xwiki-commons-core/xwiki-commons-xml/src/test/java/org/xwiki/xml/html/HTMLUtilsTest.java"},"deprecated":false,"digest":{"line_hashes":["156504677260204377671696440499567850469","247343480300824651837656543148519265883","113386197839516349287704500437306219908","322673284195321135103462141240277913312","136345578430223517814355321952931860046","185477952013263949858416934711608704960","310207289903974517150950213012611969305","158411965541081771107588906419415300814","205678474758382076456454381747043583833","211272310109666992438121260473892985054","315173356098519678231600150169811701770","296455746536956542806353135172048661986","324859443841447094869618860516406906076","150359995231223509637499978218837577282","286325354052016073681977670559167754535","150666549658745465014076851533194367669","179782245237252923669389922137019042627"],"threshold":0.9},"id":"CVE-2023-29201-1629ba29"},{"id":"CVE-2023-29201-4e2537f9","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182","target":{"file":"xwiki-commons-core/xwiki-commons-xml/src/test/java/org/xwiki/xml/html/filter/AbstractHTMLFilterTest.java"},"deprecated":false,"digest":{"line_hashes":["253579228051736445439949360731754737782","165753554576059416339197240825694222499","186819675754368847905463426786657810530","322673284195321135103462141240277913312","294717411167045028959358798229982709724","271220595858897543028379593080020369398","12139458907774238006359269919217886338","1258135844767469109405532735118296054","324208709701585894955398768449896129034","211272310109666992438121260473892985054","315173356098519678231600150169811701770","296455746536956542806353135172048661986","324859443841447094869618860516406906076","83612238711396456966553870195088737204","334632917068201865473412451813865018875","44489632054476112444144797501725306643","258061195575049261464760470319799418905"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"181637178086358719197529966309962825760","length":259},"id":"CVE-2023-29201-540f208e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182","target":{"file":"xwiki-commons-core/xwiki-commons-xml/src/main/java/org/xwiki/xml/internal/html/DefaultHTMLCleaner.java","function":"getDefaultConfiguration"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182","target":{"file":"xwiki-commons-core/xwiki-commons-xml/src/test/java/org/xwiki/xml/internal/html/DefaultHTMLCleanerTest.java","function":"cleanTitleWithNamespace"},"deprecated":false,"digest":{"function_hash":"207623819515793833525165917939084450106","length":644},"id":"CVE-2023-29201-bf8b9714","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["45659508161755575151516835119433046957","17513504622040231659752749765572161927","288393456929520018753723953293160696020","195231759649610169387195270059002247686","102042591998858958426352613811552849566","79370402471195776893761411613782907766","287370129515037640659198632191206721674"],"threshold":0.9},"id":"CVE-2023-29201-cb345805","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182","target":{"file":"xwiki-commons-core/xwiki-commons-xml/src/main/java/org/xwiki/xml/internal/html/DefaultHTMLCleaner.java"}},{"target":{"file":"xwiki-commons-core/xwiki-commons-xml/src/test/java/org/xwiki/xml/internal/html/DefaultHTMLCleanerTest.java"},"deprecated":false,"digest":{"line_hashes":["244957959710769334535494862169439866966","112381170905215627012257748942385901142","60492710700557624820802673840951765657","202566195356490590242264105911174990598","211272310109666992438121260473892985054","99181311490223259719526386734388319199","93091356693337213080485869641578573234","3219003104535869591024186316904571810","158621862400248551789561453009512580135","286145982032295837835815778999105638309","61116487373775887849401275739982669897","59468810229302661442516409975352936025","315362540169130800972813400909032526649","319022537811162762483425325131718067007","324264174000822685428404245894603730780","262995200080707010452610231377707886382","156373144977441866568767729693076512243","253250188544862661197547135103021585558","417544938929999972772285633181040632","166939720293234703231540821660290058803","209258974366659936849003414054063635996","259225520213102479138580903687459403895","111294787071890196367853303140742750669","130544806327747984262979352880100635981","78637016309151502323415420553709893102","333457680691040531257976359047648203569","337882916778649638817169326173342096999","18987311935439278863270034528297381147","266782915622503385534319018490413332819","330336676727375039375364366132924957155","311934708931356566437144569752373890123","56145897984356734153772388387997095592","147422270581155823303834311749949241582","191528396221229029706393561767938139592","331488579011000956293498736673189998919","35286241422661930902214941990049522883","85521744653750731414202799741872869573","98913369266428976209893732194569384221","238394005759944862680571761077231108003","151621086006245174733052005067064455208","50797514529270517048043637548033024938","186992110674326397323093705296405109461","128671582555965144829279209644209604981","243898047832655894940258087033654637689","295347842856282855808807235989506517198","273935192988076761449556200011468882377"],"threshold":0.9},"id":"CVE-2023-29201-ff6b1b2c","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}