CVE-2023-29201 (xwiki)

XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `<script>` and `<style>`-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like `<iframe>`. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, …

attributes code code execution commons context cross-site cve html iframe inject injection javascript javascript injection malicious milestone mode privileged privileged user programming projects restricted rights script scripting scripts security server session technical version vulnerable xss