CVE-2022-24898 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External...

CVE-2022-24898: Improper Restriction of XML External Entity Reference

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External...

XWiki Commons代码问题漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from a script that can access any file service accessed by a user running an XWiki application server via XML script injection via XML external entities...

PT-2022-16967

Name of the Vulnerable Software and Affected Versions xwiki-commons-xml versions 2.7 through 12.10.9 xwiki-commons-xml versions 13.0.0 through 13.4.3 xwiki-commons-xml versions 13.8-rc-0 and earlier Description The issue allows a script to access any file accessible to the user running the XWiki...

Cross-site Scripting (XSS)

xwiki-commons is vulnerable to cross-site scripting XSS. An attacker can inject arbitrary script via an SVG document to the upload feature of the comment section...