Read the docs
TI-2023-13896 Aliases CVE-2023-29528GHSA-x37v-36wv-6v6h

Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml

Priority MEDIUM 44CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01277 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed xwiki-commons (xwiki): 14.10org.xwiki.commons:xwiki-commons-xml (Maven): 14.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-commons4.2-milestone-1 to before 14.1014.10Patch availableCNA
—org.xwiki.commons:xwiki-commons-xml (Maven)4.2-milestone-1 to before 14.1014.10Patch availableGHSA-x37v-36wv-6v6h
  • xwiki-commons VendorXWiki Affected 4.2-milestone-1 to before 14.10 Fixed in 14.10 Patch available CNA
  • org.xwiki.commons:xwiki-commons-xml (Maven) Vendor— Affected 4.2-milestone-1 to before 14.10 Fixed in 14.10 Patch available GHSA-x37v-36wv-6v6h

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:*4.3 to before 14.10VulnerableXWiki
cpe:2.3:a:xwiki:commons:4.2:-:*:*:*:*:*:*4.2VulnerableXWiki
cpe:2.3:a:xwiki:commons:4.2:milestone1:*:*:*:*:*:*4.2 milestone1VulnerableXWiki
cpe:2.3:a:xwiki:commons:4.2:milestone2:*:*:*:*:*:*4.2 milestone2VulnerableXWiki
cpe:2.3:a:xwiki:commons:4.2:milestone3:*:*:*:*:*:*4.2 milestone3VulnerableXWiki
cpe:2.3:a:xwiki:commons:4.2:rc1:*:*:*:*:*:*4.2 rc1VulnerableXWiki
  • cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:* Versions 4.3 to before 14.10 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:commons:4.2:-:*:*:*:*:*:* Versions 4.2 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:commons:4.2:milestone1:*:*:*:*:*:* Versions 4.2 milestone1 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:commons:4.2:milestone2:*:*:*:*:*:* Versions 4.2 milestone2 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:commons:4.2:milestone3:*:*:*:*:*:* Versions 4.2 milestone3 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:commons:4.2:rc1:*:*:*:*:*:* Versions 4.2 rc1 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-commons (xwiki) Fixed in 14.10
  • Fix · GHSA-x37v-36wv-6v6h org.xwiki.commons:xwiki-commons-xml (Maven) Fixed in 14.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29528
  2. 2026-10-03 Alias added: GHSA-x37v-36wv-6v6h

References

Exploit 1

Patch 1

Advisory 3

Other 1

  • TI-2023-18312 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml CVSS 3.1CRITICAL 9.1
  • TI-2022-08708 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml CVSS 3.1MEDIUM 4.9
  • TI-2023-11288 XWiki Commons may allow privilege escalation to programming rights via user's first name CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences