CVE-2023-32070 — Improper Neutralization of Script in...

CRITICAL

Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

Published May 11, 2023Updated February 4, 2026Source: osv

Summary

### Impact HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. ### Patches This has been patched in XWiki 14.6 RC1. ### Workarounds There are no known workarounds apart from upgrading to a fixed version. ### References * https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1 * https://jira.xwiki.org/browse/XRENDERING-663 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)

Advisory Timeline

First published May 11, 2023 (1250 days ago).
Last revised February 4, 2026 — 999 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5 to 14.6-rc-1 or later

<!-- Update pom.xml dependency version to 14.6-rc-1 for org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5 -->

Maven

Update org.xwiki.platform:xwiki-platform-annotation-core to 14.6-rc-1 or later

<!-- Update pom.xml dependency version to 14.6-rc-1 for org.xwiki.platform:xwiki-platform-annotation-core -->

Maven

Update org.xwiki.rendering:xwiki-rendering-syntax-xhtml to 14.6-rc-1 or later

<!-- Update pom.xml dependency version to 14.6-rc-1 for org.xwiki.rendering:xwiki-rendering-syntax-xhtml -->

Maven

Update org.xwiki.rendering:xwiki-rendering-syntax-html5 to 14.6-rc-1 or later

<!-- Update pom.xml dependency version to 14.6-rc-1 for org.xwiki.rendering:xwiki-rendering-syntax-html5 -->

Maven

Update org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml to 14.6-rc-1 or later

<!-- Update pom.xml dependency version to 14.6-rc-1 for org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml -->

Maven

Update org.xwiki.rendering:xwiki-rendering-syntax-html to 14.6-rc-1 or later

<!-- Update pom.xml dependency version to 14.6-rc-1 for org.xwiki.rendering:xwiki-rendering-syntax-html -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (7)

Affects 1 ecosystem: maven (7).

Package	Ecosystem	Affected	Fixed In
org.xwiki.platform:xwiki-core-rendering-api	maven	All versions	Range-based data available
org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5	maven	10.0, 10.1, 10.1-rc-1, 10.10 (+281 more)	14.6-rc-1
org.xwiki.platform:xwiki-platform-annotation-core	maven	All versions	14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-xhtml	maven	10.0, 10.1, 10.1-rc-1, 10.10 (+386 more)	14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-html5	maven	10.0, 10.1, 10.1-rc-1, 10.10 (+281 more)	14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml	maven	10.0, 10.1, 10.1-rc-1, 10.10 (+345 more)	14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-html	maven	10.0, 10.1, 10.1-rc-1, 10.10 (+366 more)	14.6-rc-1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-79
Cross-site Scripting (XSS)MITRE
CWE-83
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.0 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-32070?: Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.0/10).
How do I check if my project is affected by CVE-2023-32070?: CVE-2023-32070 affects org.xwiki.platform:xwiki-core-rendering-api, org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5 and org.xwiki.platform:xwiki-platform-annotation-core (and 4 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-32070 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-6gf5-c898-7rxp

Related CVEs

CVE-2022-36100
CRITICAL
XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
CVE-2023-29514
CRITICAL
XWiki vulnerable to Code Injection in template provider administration
CVE-2023-36470
CRITICAL
XWiki Platform vulnerable to Code Injection in icon themes
CVE-2023-45134
CRITICAL
XWiki Platform XSS vulnerability from account in the create page form via template provider
CVE-2023-29525
CRITICAL
XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration
CVE-2025-53835
CRITICAL
XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
CVE-2023-29207
HIGH
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
CVE-2025-49582
HIGH
XWiki's required right warnings for macros are incomplete

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies