GHSA-6gf5-c898-7rxp

    Dashboard / Vulnerabilities / GHSA-6gf5-c898-7rxp

    GHSA-6gf5-c898-7rxp

    Published: 11 May 2023Last Modified: 4 Feb 2026

    Summary: Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

    Details: ### Impact HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. ### Patches This has been patched in XWiki 14.6 RC1. ### Workarounds There are no known workarounds apart from upgrading to a fixed version. ### References * https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1 * https://jira.xwiki.org/browse/XRENDERING-663 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:[email protected])

    References: https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp, https://nvd.nist.gov/vuln/detail/CVE-2023-32070, https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1, https://github.com/xwiki/xwiki-rendering, https://jira.xwiki.org/browse/XRENDERING-663

    Affected packages

    Package

    Name: org.xwiki.rendering:xwiki-rendering-syntax-xhtml

    Purl: pkg:maven/org.xwiki.rendering/xwiki-rendering-syntax-xhtml

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -14.6-rc-1

    Affected versions

    10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High