{"id":"GHSA-6vgh-9r3c-2cxp","summary":"Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro","details":"### Impact\nThe [Livetable Macro](https://extensions.xwiki.org/xwiki/bin/view/Extension/Livetable%20Macro) wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including JavaScript. This vulnerability was also exploitable via the [Documents Macro](https://extensions.xwiki.org/xwiki/bin/view/Extension/Documents%20Macro) that is included since XWiki 3.5M1 and doesn't require script rights, this can be demonstrated with the syntax `{{documents id=\"example\" count=\"5\" actions=\"false\" columns=\"doc.title, before\u003cscript\u003ealert(1)\u003c/script\u003eafter\"/}}`. Therefore, this can also be exploited by users without script right and in comments. With the interaction of a user with more rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content.\n\n### Patches\nThis has been patched in XWiki 14.9, 14.4.6, and 13.10.10.\n\n### Workarounds\nIt is possible to apply the [patch](https://github.com/xwiki/xwiki-platform/commit/65ca06c51e7a1d5a579344c7272b2cc9a9a21126) to existing installations without upgrading. Only the files `skins/flamingo/macros.vm` and `templates/macros.vm` in the web application directory need to be replaced by a patched version.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n","aliases":["CVE-2023-29207"],"modified":"2023-11-01T05:01:48.170025Z","published":"2023-04-12T20:43:21Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-04-12T20:43:21Z","nvd_published_at":"2023-04-15T16:15:00Z"},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6vgh-9r3c-2cxp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29207"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/65ca06c51e7a1d5a579344c7272b2cc9a9a21126"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-15205"}],"affected":[{"package":{"name":"org.xwiki.platform:xwiki-platform-flamingo-skin-resources","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-skin-resources"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9-milestone-2"},{"fixed":"13.10.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-flamingo-skin","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-skin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9-milestone-2"},{"fixed":"13.10.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-flamingo","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-flamingo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9-milestone-2"},{"fixed":"13.10.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-web-templates","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-web-templates"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9-milestone-2"},{"fixed":"13.10.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-web","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9-milestone-2"},{"fixed":"13.10.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-web-standard","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-web-standard"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9-milestone-2"},{"fixed":"13.10.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-flamingo-skin-resources","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-skin-resources"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-flamingo-skin","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-skin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-flamingo","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-flamingo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-web-templates","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-web-templates"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-web","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-web-standard","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-web-standard"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-flamingo-skin-resources","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-skin-resources"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-flamingo-skin","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-skin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-flamingo","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-flamingo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-web-templates","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-web-templates"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-web","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}},{"package":{"name":"org.xwiki.platform:xwiki-web-standard","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-web-standard"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-6vgh-9r3c-2cxp/GHSA-6vgh-9r3c-2cxp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"}]}