Detections
Analytics

SCA: security update for org.xwiki.commons:xwiki-commons-xml (GHSA-6pqf-c99p-758v)

medium Tenable Cloud Security Plugin ID 411563

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is
 included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this
 allows an attacker without script right to either create forms that can be used for phishing attacks or
 also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden"
 name="content" value="{{groovy}}println(&quot;Hello from Groovy!&quot;)" />{{/html}}` that would allow
 remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form).
 The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as
 without script right the attacker cannot display the regular content of the document. This has been
 patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed
 tags. Users are advised to upgrade. As a workaround an admin can manually disallow the tags by adding
 `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags`
 in the `xwiki.properties` configuration file. (CVE-2023-36471)

See Also

https://github.com/advisories/GHSA-6pqf-c99p-758v

Plugin Details

Severity: Medium

ID: 411563

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2023-36471

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/30/2023

Vulnerability Publication Date: 6/29/2023

Reference Information

CVE: CVE-2023-36471