CVE-2023-29202

XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter `content` was set to `true`. This allowed arbitrary HTML and in particular also JavaScript injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of a user with programming rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content and sabotaging the wiki. The issue has been patched in XWiki 14.6 RC1, the content of the feed is now properly cleaned before being displayed. As a workaround, if the RSS macro isn't used in the wiki, the macro can be uninstalled by deleting `WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar`, where `XX` is XWiki's version, in the web application's directory.

• CWE-79

• https://github.com/xwiki/xwiki-platform/commit/5c7ebe47c2897e92d8f04fe2e15027e84dc3ec03Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c885-89fw-55qrExploit, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19671Exploit, Issue Tracking, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/5c7ebe47c2897e92d8f04fe2e15027e84dc3ec03Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c885-89fw-55qrExploit, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19671Exploit, Issue Tracking, Vendor Advisory

Published

Apr 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29197guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…7.5
• CVE-2023-29198Electron is a framework which lets you write cross-platform …8.5
• CVE-2023-29199There exists a vulnerability in source code transformer (exc…10
• CVE-2023-2920Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-29200Contao is an open source content management system. Prior to…6.5
• CVE-2023-29201XWiki Commons are technical libraries common to several othe…9
• CVE-2023-29203XWiki Commons are technical libraries common to several othe…5.3
• CVE-2023-29204XWiki Commons are technical libraries common to several othe…6.1
• CVE-2023-29205XWiki Commons are technical libraries common to several othe…5.4
• CVE-2023-29206XWiki Commons are technical libraries common to several othe…5.4
• CVE-2023-29207 XWiki Commons are technical libraries common to several oth…9
• CVE-2023-29208XWiki Commons are technical libraries common to several othe…7.5