CVE-2025-53835
BaseFortify
Publication date: 2025-07-14
Last updated on: 2025-08-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xwiki | xwiki | From 5.4.5 (inc) to 14.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in XWiki Rendering versions from 5.4.5 up to but not including 14.10. The XHTML syntax depended on the `xdom+xml/current` syntax, which allows insertion of arbitrary HTML content including JavaScript via raw blocks. This enables cross-site scripting (XSS) attacks for users who can edit documents such as their user profile. The vulnerability was fixed in version 14.10 by removing this dependency. However, the `xdom+xml` syntax remains vulnerable but is intended only for testing and is not commonly used.
How can this vulnerability impact me? :
This vulnerability can lead to cross-site scripting (XSS) attacks, allowing attackers to execute arbitrary JavaScript in the context of the affected application. This can result in compromise of user accounts, theft of sensitive information, session hijacking, and potentially full system compromise depending on the privileges of the affected user. Since the vulnerability affects users who can edit documents like their user profile, it can be exploited by authenticated users with limited privileges to escalate their impact.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade XWiki Rendering to version 14.10 or later, as this version removes the vulnerable dependency on the `xdom+xml/current` syntax from the XHTML syntax. There are no known workarounds apart from upgrading.