CVE-2023-29202 (xwiki)

XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter `content` was set to `true`. This allowed arbitrary HTML and in particular also JavaScript injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of a user with programming rights, this could be used to …

actions code code execution commons cross-site cve disclosure escalation html information information disclosure injection javascript javascript injection macro malicious parameter privilege privilege escalation programming projects remote code remote code execution rights rss scripting technical wiki xss