What is the CVSS score of CVE-2023-32070?

CVE-2023-32070 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.7%.

Is there a patch available for CVE-2023-32070?

Yes, a patch is available for CVE-2023-32070. Update the affected software to the latest version immediately.

Rendering CVE-2023-32070

MEDIUM

Improper Neutralization of Script in Attributes in a Web Page (CWE-83)

2023-05-10 security-advisories@github.com

XSS Rendering Xwiki

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

May 10, 2023 - 18:15 nvd

MEDIUM 6.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5 (1 direct, 1 indirect)
3 maven packages depend on org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml (3 direct, 0 indirect)
3 maven packages depend on org.xwiki.rendering:xwiki-rendering-syntax-html5 (2 direct, 1 indirect)
7 maven packages depend on org.xwiki.rendering:xwiki-rendering-syntax-xhtml (5 direct, 2 indirect)

Ecosystem-wide dependent count for version 14.6-rc-1 and other introduced versions.

DescriptionNVD

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.

AnalysisAI

XWiki Platform is a generic wiki platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-83. XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version. Affected products include: Xwiki Rendering, Xwiki. Version information: version 14.6.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.