CVE-2023-29528

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-295295.3matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taCVE-2023-29537.5A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.CVE-2023-295306.5Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, aCVE-2023-295319.8An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crCVE-2023-295325.5A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file oCVE-2023-295334.3A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>winCVE-2023-295349.1Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential useCVE-2023-295356.5Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corrupCVE-2023-295368.8An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertioCVE-2023-295377.5Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnCVE-2023-295384.3Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URCVE-2023-295398.8When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL cha
CVE-2023-29528: Critical severity, CVSS 9.0 | Vulnix