CVE-2023-29508
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting
XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting
XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
- Record
CVE-2023-29508- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-80, CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-1326
XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
- Record
EUVD-2023-1326- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hmm7-6ph9-8jf2
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Basic Cross-site Scripting
Impact
A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights.
For instance, by adding the LiveData below in the about section of the profile of a user created by an admin.
{{liveData id="movies" properties="title,description"}}
{
"data": {
"count": 1,
"entries": [
{
"title": "Meet John Doe",
"url": "https://www.imdb.com/title/tt0033891/",
"description": "<img onerror='alert(1)' src='foo' />"
}
]
},
"meta": {
"propertyDescriptors": [
{
"id": "title",
"name": "Title",
"visible": true,
"displayer": {"id": "link", "propertyHref": "url"}
},
{
"id": "description",
"name": "Description",
"visible": true,
"displayer": "html"
}
]
}
}
{{/liveData}}
Patches
This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
Workarounds
No known workaround.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira
- Email us at Security ML
- Record
GHSA-hmm7-6ph9-8jf2- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
NVD
XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
- Record
CVE-2023-29508- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSV
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting
XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
- Record
CVE-2023-29508- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSVGHSA-hmm7-6ph9-8jf2
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Basic Cross-site Scripting
Impact
A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights.
For instance, by adding the LiveData below in the about section of the profile of a user created by an admin.
{{liveData id="movies" properties="title,description"}}
{
"data": {
"count": 1,
"entries": [
{
"title": "Meet John Doe",
"url": "https://www.imdb.com/title/tt0033891/",
"description": "<img onerror='alert(1)' src='foo' />"
}
]
},
"meta": {
"propertyDescriptors": [
{
"id": "title",
"name": "Title",
"visible": true,
"displayer": {"id": "link", "propertyHref": "url"}
},
{
"id": "description",
"name": "Description",
"visible": true,
"displayer": "html"
}
]
}
}
{{/liveData}}
Patches
This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
Workarounds
No known workaround.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira
- Email us at Security ML
- Record
GHSA-hmm7-6ph9-8jf2- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xwiki.platform:xwiki-platform-livedata-macroMaven |
13.10.10 up to 13.10.11 | 13.10.11 |
org.xwiki.platform:xwiki-platform-livedata-macroMaven |
14.4 up to 14.4.7 | 14.4.7 |
org.xwiki.platform:xwiki-platform-livedata-macroMaven |
14.9 up to 14.10 | 14.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-29508 is a high vulnerability (CVSS 8.9) in Xwiki, published April 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in org.xwiki.platform:xwiki-platform-livedata-macro 13.10.11.