CVSS Score of 10 (low)


Published Jun 29, 2023
Updated: Jul 10, 2023


CVE-2023-36471 is a critical vulnerability affecting XWiki versions 14.6RC1 to 14.10.5 and 15.0RC1 to 15.2RC1. The vulnerability exists in the HTML sanitizer of XWiki, allowing attackers without script rights to create forms for phishing attacks or execute remote code through an input field in a sheet. This can be exploited if the attacker can submit the malicious code as an admin on the XWiki platform and create a plausible-looking edit form. The issue has been addressed in XWiki versions 14.10.6 and 15.2RC1 by removing the problematic tags from the list of allowed tags, and users are advised to upgrade as a precautionary measure to mitigate potential risks to confidentiality and integrity of data.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-36471 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options