CVE-2023-29206

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script allowing to perform some operations when executing by a user with appropriate rights. This has been patched in XWiki 14.9-rc-1 by only executing the script if the author of it has Script rights.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-292079.0XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing colum CVE-2023-292087.5XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into accoun CVE-2023-292098.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible doc CVE-2023-29218.8The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to CVE-2023-292108.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible doc CVE-2023-292118.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` c CVE-2023-292128.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groo CVE-2023-292138.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.CVE-2023-292148.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groo CVE-2023-292159.8In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in J CVE-2023-292169.8In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious paramet CVE-2023-292187.5The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arrang