CVE-2023-32070

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

• CWE-83
• CWE-79
• CWE-79

• https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1Patch
• https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxpPatch, Vendor Advisory
• https://jira.xwiki.org/browse/XRENDERING-663Vendor Advisory
• https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1Patch
• https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxpPatch, Vendor Advisory
• https://jira.xwiki.org/browse/XRENDERING-663Vendor Advisory

Published

May 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32065OroCommerce is an open-source Business to Business Commerce …5.8
• CVE-2023-32066Time Tracker is an open source time tracking system. The wee…5.4
• CVE-2023-32067c-ares is an asynchronous resolver library. c-ares is vulner…7.5
• CVE-2023-32068XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-32069XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-3207Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-32071XWiki Platform is a generic wiki platform. Starting in versi…9
• CVE-2023-32072Tuleap is an open source tool for end to end traceability of…4.8
• CVE-2023-32073WWBN AVideo is an open source video platform. In versions 12…8.8
• CVE-2023-32074user_oidc app is an OpenID Connect user backend for Nextclou…9.8
• CVE-2023-32075The Customer Management Framework (CMF) for Pimcore adds fun…4.3
• CVE-2023-32076in-toto is a framework to protect supply chain integrity. Th…5.5