CVE-2023-29528 is a critical cross-site scripting (XSS) vulnerability affecting XWiki Commons, specifically within its HTML cleaner's "restricted" mode. This flaw allows for the injection of arbitrary HTML and JavaScript via invalid HTML comments. When a privileged user with programming rights views such a comment, the malicious JavaScript executes, leading to server-side code execution and impacting the confidentiality, integrity, and availability of the XWiki instance. The vulnerability carries a CVSS score of 9.0 (CRITICAL), indicating a high-impact, easily exploitable threat. It has a network attack vector, low attack complexity, and requires user interaction, but the potential for complete compromise of the system is significant. The CWE is CWE-79 (Improper Neutralization of Input During Web Page Generation). Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage are minimal, suggesting low public awareness at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.3, < 14.10CPE matchmatch criteria | cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:* | ||
4.2CPE matchmatch criteria | cpe:2.3:a:xwiki:commons:4.2:-:*:*:*:*:*:* | ||
4.2CPE matchmatch criteria | cpe:2.3:a:xwiki:commons:4.2:milestone1:*:*:*:*:*:* | ||
4.2CPE matchmatch criteria | cpe:2.3:a:xwiki:commons:4.2:milestone2:*:*:*:*:*:* | ||
4.2CPE matchmatch criteria | cpe:2.3:a:xwiki:commons:4.2:milestone3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.6 Bluesky, 0.3 Mastodon, and 1.6 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.