CVE-2023-29207

Deeper analysis

XWiki Commons contains an unsanitized column-name handling flaw in the Livetable Macro that permits insertion of arbitrary HTML and JavaScript. The same vector is reachable through the Documents Macro (present since XWiki 3.5M1) without requiring script rights, as demonstrated by the syntax {{documents id="example" count="5" actions="false" columns="doc.title, before<script>alert(1)</script>after"/}}. The issue therefore affects any XWiki instance exposing these macros to authenticated or comment-posting users.

An attacker needs only low-privileged access to inject the payload; when a higher-privileged user later views the affected page or comment, the script executes in that user's context. Successful exploitation can yield privilege escalation, remote code execution, content tampering, or information disclosure inside the wiki.

The vulnerability is fixed in XWiki 14.9, 14.4.6, and 13.10.10; the corresponding commits and GitHub Security Advisory GHSA-6vgh-9r3c-2cxp document the sanitization changes applied to column handling. The EPSS score has remained flat at 0.1765 since disclosure, indicating no material increase in observed exploitation interest.