CVE-2023-29206

Deeper analysis

XWiki Commons, the shared technical libraries used across multiple XWiki projects, contained an authorization flaw affecting JavaScript and StyleSheet XObjects stored in wiki documents. The code performed no verification of the object's author before execution, allowing any user granted only Edit rights to introduce executable content that would later run under the privileges of a user possessing Script rights. The issue is tracked as CWE-79 and received a CVSS 3.1 score of 9.0.

An attacker with Edit access on a document can therefore embed a malicious script or stylesheet. When a privileged user subsequently views or interacts with that document, the script executes in the privileged context, enabling actions such as data exfiltration, privilege escalation, or arbitrary content modification within the wiki.

The vulnerability was addressed in XWiki 14.9-rc-1 by adding an explicit author-rights check that prevents script execution unless the object's author itself holds Script rights. The fix is documented in the project's GitHub advisory GHSA-cmvg-w72j-7phx and the associated commits and Jira issues.

EPSS scores have remained low, reaching a peak of only 0.0653 before receding to the current value of 0.0442, indicating limited observed exploitation interest since disclosure.