Every CVE Search/ Get API key

CVE-2023-32070

Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

9.1 CriticalPublic exploitFix available

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.65%Up 0.6 points since May 11, 2023
90%50%10%1%

What each source reports

CVE List Score used 9.1

Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

Record
CVE-2023-32070
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-83, CWE-79
Updated
2026-11-02
EUVDEUVD-2023-1481 9.1

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

Record
EUVD-2023-1481
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-6gf5-c898-7rxp 9.0

Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

Impact

HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax.

Patches

This has been patched in XWiki 14.6 RC1.

Workarounds

There are no known workarounds apart from upgrading to a fixed version.

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-6gf5-c898-7rxp
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79, CWE-83
Updated
2026-11-02
NVD 9.0

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

Record
CVE-2023-32070
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-83, CWE-79
Updated
2026-11-02
OSV 9.0

Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

Record
CVE-2023-32070
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-83
Updated
2026-11-02
OSVGHSA-6gf5-c898-7rxp 9.0

Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

Impact

HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax.

Patches

This has been patched in XWiki 14.6 RC1.

Workarounds

There are no known workarounds apart from upgrading to a fixed version.

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-6gf5-c898-7rxp
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79, CWE-83
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.xwiki.rendering:xwiki-rendering-syntax-xhtml
Maven
 before 14.6-rc-1
14.6-rc-1
org.xwiki.platform:xwiki-core-rendering-api
Maven
 through 3.0-milestone-2 None known
org.xwiki.rendering:xwiki-rendering-syntax-html
Maven
 before 14.6-rc-1
14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-html5
Maven
 before 14.6-rc-1
14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml
Maven
 before 14.6-rc-1
14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5
Maven
 before 14.6-rc-1
14.6-rc-1
org.xwiki.platform:xwiki-platform-annotation-core
Maven
 before 14.6-rc-1
14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-xhtml
Maven
 before 14.6-rc-1, plus listed versions
10.010.110.1-rc-110.1010.10-rc-1
Show 45 moreShow less
10.1110.11-rc-110.11.110.11.1010.11.1110.11.210.11.310.11.410.11.510.11.610.11.710.11.810.11.910.210.310.410.4-rc-110.510.5-rc-110.610.6-rc-110.6.110.710.7-rc-110.7.110.810.8-rc-110.8.110.8.210.8.310.911.011.0.111.0.211.0.311.111.1-rc-111.1011.10.111.10.1011.10.1111.10.1211.10.1311.10.211.10.3
14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-html
Maven
 before 14.6-rc-1, plus listed versions
10.010.110.1-rc-110.1010.10-rc-1
Show 45 moreShow less
10.1110.11-rc-110.11.110.11.1010.11.1110.11.210.11.310.11.410.11.510.11.610.11.710.11.810.11.910.210.310.410.4-rc-110.510.5-rc-110.610.6-rc-110.6.110.710.7-rc-110.7.110.810.8-rc-110.8.110.8.210.8.310.911.011.0.111.0.211.0.311.111.1-rc-111.1011.10.111.10.1011.10.1111.10.1211.10.1311.10.211.10.3
14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-html5
Maven
 before 14.6-rc-1, plus listed versions
10.010.110.1-rc-110.1010.10-rc-1
Show 45 moreShow less
10.1110.11-rc-110.11.110.11.1010.11.1110.11.210.11.310.11.410.11.510.11.610.11.710.11.810.11.910.210.310.410.4-rc-110.510.5-rc-110.610.6-rc-110.6.110.710.7-rc-110.7.110.810.8-rc-110.8.110.8.210.8.310.911.011.0.111.0.211.0.311.111.1-rc-111.1011.10.111.10.1011.10.1111.10.1211.10.1311.10.211.10.3
14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml
Maven
 before 14.6-rc-1, plus listed versions
10.010.110.1-rc-110.1010.10-rc-1
Show 45 moreShow less
10.1110.11-rc-110.11.110.11.1010.11.1110.11.210.11.310.11.410.11.510.11.610.11.710.11.810.11.910.210.310.410.4-rc-110.510.5-rc-110.610.6-rc-110.6.110.710.7-rc-110.7.110.810.8-rc-110.8.110.8.210.8.310.911.011.0.111.0.211.0.311.111.1-rc-111.1011.10.111.10.1011.10.1111.10.1211.10.1311.10.211.10.3
14.6-rc-1
org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5
Maven
 before 14.6-rc-1, plus listed versions
10.010.110.1-rc-110.1010.10-rc-1
Show 45 moreShow less
10.1110.11-rc-110.11.110.11.1010.11.1110.11.210.11.310.11.410.11.510.11.610.11.710.11.810.11.910.210.310.410.4-rc-110.510.5-rc-110.610.6-rc-110.6.110.710.7-rc-110.7.110.810.8-rc-110.8.110.8.210.8.310.911.011.0.111.0.211.0.311.111.1-rc-111.1011.10.111.10.1011.10.1111.10.1211.10.1311.10.211.10.3
14.6-rc-1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubshoucheng3/xwiki__xwiki-rendering_CVE-2023-32070_14-52025-08-16

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-32070 is a critical vulnerability (CVSS 9.1) in Xwiki Rendering, published May 10, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in org.xwiki.rendering:xwiki-rendering-syntax-xhtml 14.6-rc-1.

References

This page doesn't list everything

Left out here: 1,429 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open