CVE-2023-29205 — Vulnerability in...

CRITICAL

org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro

Published April 12, 2023Updated September 10, 2026Source: osv

Summary

### Impact The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be particularly dangerous since in a standard wiki, any user is able to use the html macro directly in their own user profile page. ### Patches The problem has been patched in XWiki 14.8RC1. The patch involve that the HTML macro are systematically cleaned up whenever the user does not have script right. ### Workarounds There's no workaround for this issue. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira](https://jira.xwiki.org) * Email us at [security ML](mailto:security@xwiki.org)

Advisory Timeline

First published April 12, 2023 (1279 days ago).
Last revised September 10, 2026 — 1246 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.xwiki.platform:xwiki-platform-rendering-xwiki to 14.8-rc-1 or later

<!-- Update pom.xml dependency version to 14.8-rc-1 for org.xwiki.platform:xwiki-platform-rendering-xwiki -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
org.xwiki.platform:xwiki-platform-rendering-xwiki	maven	All versions	14.8-rc-1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-79
Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-29205?: org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2023-29205?: CVE-2023-29205 affects org.xwiki.platform:xwiki-platform-rendering-xwiki. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-29205 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-vxf7-mx22-jr24

Related CVEs

CVE-2023-26474
CRITICAL
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
CVE-2023-29514
CRITICAL
XWiki vulnerable to Code Injection in template provider administration
CVE-2023-36470
CRITICAL
XWiki Platform vulnerable to Code Injection in icon themes
CVE-2023-34464
CRITICAL
XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
CVE-2023-45134
CRITICAL
XWiki Platform XSS vulnerability from account in the create page form via template provider
CVE-2025-55747
CRITICAL
XWiki configuration files can be accessed through the webjars API
CVE-2023-29207
HIGH
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
CVE-2025-49582
HIGH
XWiki's required right warnings for macros are incomplete

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies