CVE-2023-29201

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-29201
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29201.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-29201
Aliases
Published
2023-04-15T14:24:59.250Z
Modified
2026-08-08T09:06:43.146021Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability
Details

XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped <script> and <style>-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like <iframe>. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode. There are no known workarounds apart from upgrading to a version including the fix.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29201.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
dc5230e69b18da6030585a398aa722c7ebebaff1
Fixed
4a185e0594d90cd4916d60aa60bb4333dc5623b2
Fixed
b11eae9d82cb53f32962056b5faa73f3720c6182
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.0"
        },
        {
            "last_affected": "14.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
e20ad8657a7859e0cc4c7e86d360fa494ede584c
Last affected
ab4dfeaeef13360eebcaa507bc652073aa89a427
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.0"
        },
        {
            "last_affected": "14.5"
        }
    ]
}

Database specific

vanir_signatures_modified 
"2026-08-08T09:06:43Z"
vanir_signatures 
[
    {
        "target": {
            "file": "xwiki-commons-core/xwiki-commons-xml/src/test/java/org/xwiki/xml/html/HTMLUtilsTest.java"
        },
        "digest": {
            "line_hashes": [
                "156504677260204377671696440499567850469",
                "247343480300824651837656543148519265883",
                "113386197839516349287704500437306219908",
                "322673284195321135103462141240277913312",
                "136345578430223517814355321952931860046",
                "185477952013263949858416934711608704960",
                "310207289903974517150950213012611969305",
                "158411965541081771107588906419415300814",
                "205678474758382076456454381747043583833",
                "211272310109666992438121260473892985054",
                "315173356098519678231600150169811701770",
                "296455746536956542806353135172048661986",
                "324859443841447094869618860516406906076",
                "150359995231223509637499978218837577282",
                "286325354052016073681977670559167754535",
                "150666549658745465014076851533194367669",
                "179782245237252923669389922137019042627"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2023-29201-1629ba29",
        "source": "https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182"
    },
    {
        "target": {
            "file": "xwiki-commons-core/xwiki-commons-xml/src/test/java/org/xwiki/xml/html/filter/AbstractHTMLFilterTest.java"
        },
        "digest": {
            "line_hashes": [
                "253579228051736445439949360731754737782",
                "165753554576059416339197240825694222499",
                "186819675754368847905463426786657810530",
                "322673284195321135103462141240277913312",
                "294717411167045028959358798229982709724",
                "271220595858897543028379593080020369398",
                "12139458907774238006359269919217886338",
                "1258135844767469109405532735118296054",
                "324208709701585894955398768449896129034",
                "211272310109666992438121260473892985054",
                "315173356098519678231600150169811701770",
                "296455746536956542806353135172048661986",
                "324859443841447094869618860516406906076",
                "83612238711396456966553870195088737204",
                "334632917068201865473412451813865018875",
                "44489632054476112444144797501725306643",
                "258061195575049261464760470319799418905"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2023-29201-4e2537f9",
        "source": "https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182"
    },
    {
        "target": {
            "function": "getDefaultConfiguration",
            "file": "xwiki-commons-core/xwiki-commons-xml/src/main/java/org/xwiki/xml/internal/html/DefaultHTMLCleaner.java"
        },
        "digest": {
            "length": 259.0,
            "function_hash": "181637178086358719197529966309962825760"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2023-29201-540f208e",
        "source": "https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182"
    },
    {
        "target": {
            "function": "cleanTitleWithNamespace",
            "file": "xwiki-commons-core/xwiki-commons-xml/src/test/java/org/xwiki/xml/internal/html/DefaultHTMLCleanerTest.java"
        },
        "digest": {
            "length": 644.0,
            "function_hash": "207623819515793833525165917939084450106"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2023-29201-bf8b9714",
        "source": "https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182"
    },
    {
        "target": {
            "file": "xwiki-commons-core/xwiki-commons-xml/src/main/java/org/xwiki/xml/internal/html/DefaultHTMLCleaner.java"
        },
        "digest": {
            "line_hashes": [
                "45659508161755575151516835119433046957",
                "17513504622040231659752749765572161927",
                "288393456929520018753723953293160696020",
                "195231759649610169387195270059002247686",
                "102042591998858958426352613811552849566",
                "79370402471195776893761411613782907766",
                "287370129515037640659198632191206721674"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2023-29201-cb345805",
        "source": "https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182"
    },
    {
        "target": {
            "file": "xwiki-commons-core/xwiki-commons-xml/src/test/java/org/xwiki/xml/internal/html/DefaultHTMLCleanerTest.java"
        },
        "digest": {
            "line_hashes": [
                "244957959710769334535494862169439866966",
                "112381170905215627012257748942385901142",
                "60492710700557624820802673840951765657",
                "202566195356490590242264105911174990598",
                "211272310109666992438121260473892985054",
                "99181311490223259719526386734388319199",
                "93091356693337213080485869641578573234",
                "3219003104535869591024186316904571810",
                "158621862400248551789561453009512580135",
                "286145982032295837835815778999105638309",
                "61116487373775887849401275739982669897",
                "59468810229302661442516409975352936025",
                "315362540169130800972813400909032526649",
                "319022537811162762483425325131718067007",
                "324264174000822685428404245894603730780",
                "262995200080707010452610231377707886382",
                "156373144977441866568767729693076512243",
                "253250188544862661197547135103021585558",
                "417544938929999972772285633181040632",
                "166939720293234703231540821660290058803",
                "209258974366659936849003414054063635996",
                "259225520213102479138580903687459403895",
                "111294787071890196367853303140742750669",
                "130544806327747984262979352880100635981",
                "78637016309151502323415420553709893102",
                "333457680691040531257976359047648203569",
                "337882916778649638817169326173342096999",
                "18987311935439278863270034528297381147",
                "266782915622503385534319018490413332819",
                "330336676727375039375364366132924957155",
                "311934708931356566437144569752373890123",
                "56145897984356734153772388387997095592",
                "147422270581155823303834311749949241582",
                "191528396221229029706393561767938139592",
                "331488579011000956293498736673189998919",
                "35286241422661930902214941990049522883",
                "85521744653750731414202799741872869573",
                "98913369266428976209893732194569384221",
                "238394005759944862680571761077231108003",
                "151621086006245174733052005067064455208",
                "50797514529270517048043637548033024938",
                "186992110674326397323093705296405109461",
                "128671582555965144829279209644209604981",
                "243898047832655894940258087033654637689",
                "295347842856282855808807235989506517198",
                "273935192988076761449556200011468882377"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2023-29201-ff6b1b2c",
        "source": "https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29201.json"