Detections
Analytics

SCA: security update for org.xwiki.platform:xwiki-platform-flamingo, org.xwiki.platform:xwiki-platform-flamingo-skin, org.xwiki.platform:xwiki-platform-flamingo-skin-resources, org.xwiki.platform:xwiki-platform-web, org.xwiki.platform:xwiki-platform-web-templates, org.xwiki.platform:xwiki-web-standard (GHSA-6vgh-9r3c-2cxp)

critical Tenable Self-Hosted Container Security Plugin ID 411638

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable
 Macro wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including
 JavaScript. This vulnerability was also exploitable via the Documents Macro that is included since XWiki
 3.5M1 and doesn't require script rights, this can be demonstrated with the syntax `{{documents
 id="example" count="5" actions="false" columns="doc.title, before<script>alert(1)</script>after"/}}`.
 Therefore, this can also be exploited by users without script right and in comments. With the interaction
 of a user with more rights, this could be used to execute arbitrary actions in the wiki, including
 privilege escalation, remote code execution, information disclosure, modifying or deleting content. This
 has been patched in XWiki 14.9, 14.4.6, and 13.10.10. (CVE-2023-29207)

See Also

https://github.com/advisories/GHSA-6vgh-9r3c-2cxp

Plugin Details

Severity: Critical

ID: 411638

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.66

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-29207

CVSS v3

Risk Factor: Critical

Base Score: 9

Temporal Score: 8.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/12/2023

Vulnerability Publication Date: 4/12/2023

Reference Information

CVE: CVE-2023-29207

cwe: CWE-79