CVE-2023-29206

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-29206
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29206.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-29206
Aliases
Published
2023-04-15T15:41:56.041Z
Modified
2026-03-01T02:47:45.189100Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins
Details

XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script allowing to perform some operations when executing by a user with appropriate rights. This has been patched in XWiki 14.9-rc-1 by only executing the script if the author of it has Script rights.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29206.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
804f16c0efbf6ba3d08c7ad780b81b7203741d8c
Fixed
85f3a7c74a321e68aa6b99d0d3cf6fddde70aa7c

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29206.json"