CVE-2023-32070: Improper Neutralization of Script in Attributes in a Web Page

May 11, 2023

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn’t check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

References

github.com/advisories/GHSA-6gf5-c898-7rxp
github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1
github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp
jira.xwiki.org/browse/XRENDERING-663
nvd.nist.gov/vuln/detail/CVE-2023-32070

Code Behaviors & Features

Detect and mitigate CVE-2023-32070 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →