Read the docs
TI-2023-18312 Aliases CVE-2023-36471GHSA-6pqf-c99p-758v

HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml

Priority HIGH 74CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{groovy}}println(&quot;Hello from Groovy!&quot;)" />{{/html}}` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document. This has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags. Users are advised to upgrade. As a workaround an admin can manually disallow the tags by adding `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags` in the `xwiki.properties` configuration file.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01029 63rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed xwiki-commons (xwiki): 14.10.6, 15.2-rc-1org.xwiki.commons:xwiki-commons-xml (Maven): 14.10.6, 15.2-rc-1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-commons14.6-rc-1 to before 14.10.6; 15.0-rc-1 to before 15.2-rc-114.10.6, 15.2-rc-1Patch availableCNA
—org.xwiki.commons:xwiki-commons-xml (Maven)14.6-rc-1 to before 14.10.614.10.6Patch availableGHSA-6pqf-c99p-758v
—org.xwiki.commons:xwiki-commons-xml (Maven)15.0-rc-1 to before 15.2-rc-115.2-rc-1Patch availableGHSA-6pqf-c99p-758v
  • xwiki-commons VendorXWiki Affected 14.6-rc-1 to before 14.10.6; 15.0-rc-1 to before 15.2-rc-1 Fixed in 14.10.6, 15.2-rc-1 Patch available CNA
  • org.xwiki.commons:xwiki-commons-xml (Maven) Vendor— Affected 14.6-rc-1 to before 14.10.6 Fixed in 14.10.6 Patch available GHSA-6pqf-c99p-758v
  • org.xwiki.commons:xwiki-commons-xml (Maven) Vendor— Affected 15.0-rc-1 to before 15.2-rc-1 Fixed in 15.2-rc-1 Patch available GHSA-6pqf-c99p-758v

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:*14.6 to before 14.10.6VulnerableXWiki
cpe:2.3:a:xwiki:commons:15.0:-:*:*:*:*:*:*15.0VulnerableXWiki
cpe:2.3:a:xwiki:commons:15.0:rc1:*:*:*:*:*:*15.0 rc1VulnerableXWiki
cpe:2.3:a:xwiki:commons:15.1:-:*:*:*:*:*:*15.1VulnerableXWiki
cpe:2.3:a:xwiki:commons:15.1:rc1:*:*:*:*:*:*15.1 rc1VulnerableXWiki
  • cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:* Versions 14.6 to before 14.10.6 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:commons:15.0:-:*:*:*:*:*:* Versions 15.0 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:commons:15.0:rc1:*:*:*:*:*:* Versions 15.0 rc1 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:commons:15.1:-:*:*:*:*:*:* Versions 15.1 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:commons:15.1:rc1:*:*:*:*:*:* Versions 15.1 rc1 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-commons (xwiki) Fixed in 14.10.6, 15.2-rc-1
  • Fix · GHSA-6pqf-c99p-758v org.xwiki.commons:xwiki-commons-xml (Maven) Fixed in 14.10.6 Advisory →
  • Fix · GHSA-6pqf-c99p-758v org.xwiki.commons:xwiki-commons-xml (Maven) Fixed in 15.2-rc-1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-36471
  2. 2026-10-03 Alias added: GHSA-6pqf-c99p-758v

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2022-08708 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml CVSS 3.1MEDIUM 4.9
  • TI-2023-11288 XWiki Commons may allow privilege escalation to programming rights via user's first name CVSS 3.1CRITICAL 10.0
  • TI-2023-13896 Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences