CVE-2023-29207
HIGH
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
Published April 12, 2023Updated November 8, 2023Source: osv
Summary
### Impact
The [Livetable Macro](https://extensions.xwiki.org/xwiki/bin/view/Extension/Livetable%20Macro) wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including JavaScript. This vulnerability was also exploitable via the [Documents Macro](https://extensions.xwiki.org/xwiki/bin/view/Extension/Documents%20Macro) that is included since XWiki 3.5M1 and doesn't require script rights, this can be demonstrated with the syntax `{{documents id="example" count="5" actions="false" columns="doc.title, before<script>alert(1)</script>after"/}}`. Therefore, this can also be exploited by users without script right and in comments. With the interaction of a user with more rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content.
### Patches
This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.
### Workarounds
It is possible to apply the [patch](https://github.com/xwiki/xwiki-platform/commit/65ca06c51e7a1d5a579344c7272b2cc9a9a21126) to existing installations without upgrading. Only the files `skins/flamingo/macros.vm` and `templates/macros.vm` in the web application directory need to be replaced by a patched version.
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update org.xwiki.platform:xwiki-platform-web to 14.9 or later<!-- Update pom.xml dependency version to 14.9 for org.xwiki.platform:xwiki-platform-web -->
Maven
Update org.xwiki.platform:xwiki-platform-flamingo-skin to 13.10.10 or later<!-- Update pom.xml dependency version to 13.10.10 for org.xwiki.platform:xwiki-platform-flamingo-skin -->
Maven
Update org.xwiki.platform:xwiki-platform-web-templates to 14.9 or later<!-- Update pom.xml dependency version to 14.9 for org.xwiki.platform:xwiki-platform-web-templates -->
Maven
Update org.xwiki.platform:xwiki-platform-flamingo-skin to 14.4.6 or later<!-- Update pom.xml dependency version to 14.4.6 for org.xwiki.platform:xwiki-platform-flamingo-skin -->
Maven
Update org.xwiki.platform:xwiki-platform-flamingo-skin-resources to 14.4.6 or later<!-- Update pom.xml dependency version to 14.4.6 for org.xwiki.platform:xwiki-platform-flamingo-skin-resources -->
Maven
Update org.xwiki.platform:xwiki-platform-flamingo to 14.9 or later<!-- Update pom.xml dependency version to 14.9 for org.xwiki.platform:xwiki-platform-flamingo -->
Maven
Update org.xwiki.platform:xwiki-platform-web to 13.10.10 or later<!-- Update pom.xml dependency version to 13.10.10 for org.xwiki.platform:xwiki-platform-web -->
Maven
Update org.xwiki.platform:xwiki-platform-flamingo to 13.10.10 or later<!-- Update pom.xml dependency version to 13.10.10 for org.xwiki.platform:xwiki-platform-flamingo -->
Maven
Update org.xwiki.platform:xwiki-platform-flamingo-skin-resources to 13.10.10 or later<!-- Update pom.xml dependency version to 13.10.10 for org.xwiki.platform:xwiki-platform-flamingo-skin-resources -->
Maven
Update org.xwiki.platform:xwiki-web-standard to 14.4.6 or later<!-- Update pom.xml dependency version to 14.4.6 for org.xwiki.platform:xwiki-web-standard -->
Maven
Update org.xwiki.platform:xwiki-platform-web to 14.4.6 or later<!-- Update pom.xml dependency version to 14.4.6 for org.xwiki.platform:xwiki-platform-web -->
Maven
Update org.xwiki.platform:xwiki-platform-web-templates to 14.4.6 or later<!-- Update pom.xml dependency version to 14.4.6 for org.xwiki.platform:xwiki-platform-web-templates -->
Maven
Update org.xwiki.platform:xwiki-platform-flamingo-skin-resources to 14.9 or later<!-- Update pom.xml dependency version to 14.9 for org.xwiki.platform:xwiki-platform-flamingo-skin-resources -->
Maven
Update org.xwiki.platform:xwiki-platform-flamingo-skin to 14.9 or later<!-- Update pom.xml dependency version to 14.9 for org.xwiki.platform:xwiki-platform-flamingo-skin -->
Maven
Update org.xwiki.platform:xwiki-platform-web-templates to 13.10.10 or later<!-- Update pom.xml dependency version to 13.10.10 for org.xwiki.platform:xwiki-platform-web-templates -->
Maven
Update org.xwiki.platform:xwiki-web-standard to 14.9 or later<!-- Update pom.xml dependency version to 14.9 for org.xwiki.platform:xwiki-web-standard -->
Maven
Update org.xwiki.platform:xwiki-platform-flamingo to 14.4.6 or later<!-- Update pom.xml dependency version to 14.4.6 for org.xwiki.platform:xwiki-platform-flamingo -->
Maven
Update org.xwiki.platform:xwiki-web-standard to 13.10.10 or later<!-- Update pom.xml dependency version to 13.10.10 for org.xwiki.platform:xwiki-web-standard -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (18)
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-79Cross-site Scripting (XSS)MITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 8.9 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6vgh-9r3c-2cxpWEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-29207ADVISORY
- https://github.com/xwiki/xwiki-platform/commit/65ca06c51e7a1d5a579344c7272b2cc9a9a21126WEB
- https://github.com/xwiki/xwiki-platformPACKAGE
- https://jira.xwiki.org/browse/XWIKI-15205WEB
Frequently Asked Questions
- What is CVE-2023-29207?
- Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.9/10).
- How do I check if my project is affected by CVE-2023-29207?
- CVE-2023-29207 affects org.xwiki.platform:xwiki-platform-web, org.xwiki.platform:xwiki-platform-flamingo-skin and org.xwiki.platform:xwiki-platform-web-templates (and 3 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-29207 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
8.9
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-6vgh-9r3c-2cxp
Related CVEs
- CVE-2024-41947CRITICAL
XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
- CVE-2023-35156CRITICAL
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template
- CVE-2023-45137CRITICAL
XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages
- CVE-2023-34464CRITICAL
XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
- CVE-2023-45135CRITICAL
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
- CVE-2023-45134CRITICAL
XWiki Platform XSS vulnerability from account in the create page form via template provider
- CVE-2023-29512CRITICAL
xwiki-platform-web-templates vulnerable to Eval Injection
- CVE-2025-66472MEDIUM
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies