High
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting
Type: advisorySources: OSV
XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-29508
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 00:31 UTC · Revision 1
Source evidence
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting
core-osv · Original sourcePublished 16 Apr 2023, 07:00 UTC
XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
osv:CVE-2023-29508
Complete source record
{
"id": "1c27ab95156104c3a836ca5847b30e073b1c13a34e888f764b49cc626a3332cf",
"url": "https://osv.dev/vulnerability/CVE-2023-29508",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting",
"summary": "XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.",
"evidence": "osv:CVE-2023-29508",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2023-29508",
"aliases": [
"CVE-2023-29508",
"GHSA-hmm7-6ph9-8jf2"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/xwiki/xwiki-commons",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8d72461ba6976af6005e2df511bdeeeb17ef2d74"
},
{
"fixed": "5d5ba1ade22d91d0fd6bf3dd20bb96fa64264a97"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "13.10.11"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.4.0"
},
{
"fixed": "14.4.7"
}
],
"source": "CPE_RANGE"
}
]
}
},
{
"repo": "https://github.com/xwiki/xwiki-platform",
"type": "GIT",
"events": [
{
"introduced": "61a67f5cf241df692779d77367168e0762119091"
},
{
"fixed": "08e0887f0362b21614e6bfcb5be7e1f568659c41"
},
{
"introduced": "5d23a4d1ec341678fa8f1c2ac60d50f0a16f5e3b"
},
{
"fixed": "962ee4ac0352ab1a89cc779c29e81b0674d0203e"
},
{
"introduced": "101becab4069ae9ccdc8c2f2c4edc562645e152b"
},
{
"fixed": "c524887d154ff8f6df9651e36b904e234bf5a6ef"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "13.10.10"
},
{
"fixed": "13.10.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "14.4"
},
{
"fixed": "14.4.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "14.9"
},
{
"fixed": "14.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
}
],
"versions": [
"xwiki-commons-13.10.10",
"xwiki-commons-14.4.6",
"xwiki-commons-14.4.5",
"xwiki-commons-14.4.4",
"xwiki-commons-13.10.9",
"xwiki-commons-14.4.3",
"xwiki-commons-13.10.8",
"xwiki-commons-14.4.2",
"xwiki-commons-13.10.7",
"xwiki-commons-14.4.1",
"xwiki-commons-13.10.6",
"xwiki-commons-14.4",
"xwiki-commons-14.4-rc-1",
"xwiki-commons-13.10.5",
"xwiki-commons-13.10.4",
"xwiki-commons-13.10.3",
"xwiki-commons-13.10.2",
"xwiki-commons-13.10.1",
"xwiki-commons-13.10",
"xwiki-commons-13.10-rc-1",
"xwiki-commons-8.3-milestone-2",
"xwiki-commons-8.3-milestone-1",
"xwiki-commons-8.2-milestone-2",
"xwiki-commons-8.2-milestone-1",
"xwiki-commons-8.1-milestone-2",
"xwiki-commons-8.1-milestone-1",
"xwiki-commons-8.0-milestone-2",
"xwiki-commons-8.0-milestone-1",
"xwiki-platform-13.10.10",
"xwiki-platform-14.4.6",
"xwiki-platform-14.4.5",
"xwiki-platform-14.4.4",
"xwiki-platform-14.4.3",
"xwiki-platform-14.4.2",
"xwiki-platform-14.4.1",
"xwiki-platform-14.4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29508.json"
}
}
],
"modified": "2026-10-28T02:30:52.189312794Z",
"provider": "osv",
"references": [
"https://jira.xwiki.org/browse/XWIKI-20312",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29508.json",
"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hmm7-6ph9-8jf2",
"https://nvd.nist.gov/vuln/detail/CVE-2023-29508"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79",
"CWE-80"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29508.json"
}
},
"related_cves": [
{
"value": "CVE-2023-29508",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 520992,
"published_at": "2023-04-16T07:00:43.391+00:00"
}