XWiki Component XSS

The vulnerability of the org.xwiki.commons:xwiki-commons-xml component of the XWiki platform, a web application development platform, stems from the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker, operating remotely, to carry out XSS...

HTML Injection

xwiki-commons-xml is vulnerable to HTML Injection. The vulnerability exists because the HTMLDefinitions function in HTMLDefinitions.java does not properly disallow form-related tags in the HTML sanitizer, which allows an attacker to inject and execute malicious code such as html/html through the...

org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.5), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.5) +35 more potentially affected by CVE-2023-36471 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.5)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.5 and more Source cves: CVE-2023-36471 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=15.0-rc-1, <=15.1), org.xwiki.commons:xwiki-commons-diff-xml (>=15.0-rc-1, <=15.1) +35 more potentially affected by CVE-2023-36471 via org.xwiki.commons:xwiki-commons-xml (>=15.0-rc-1, <=15.1)

org.xwiki.commons:xwiki-commons-xml MAVEN version =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.1 and more Source cves: CVE-2023-36471 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=15.0-rc-1, <=15.1), org.xwiki.commons:xwiki-commons-diff-xml (>=15.0-rc-1, <=15.1) +35 more potentially affected by CVE-2023-36471 via org.xwiki.commons:xwiki-commons-xml (>=15.0-rc-1, <=15.1)

org.xwiki.commons:xwiki-commons-xml MAVEN version =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.1 and more Source cves: CVE-2023-36471 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.5), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.5) +35 more potentially affected by CVE-2023-36471 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.5)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.5 and more Source cves: CVE-2023-36471 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.3) +35 more potentially affected by CVE-2023-31126 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.3 and more Source cves: CVE-2023-31126 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.3) +35 more potentially affected by CVE-2023-31126 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.3 and more Source cves: CVE-2023-31126 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.3) +35 more potentially affected by CVE-2023-31126 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.3 and more Source cves: CVE-2023-31126 Source...

CVE-2023-31126

org.xwiki.commons:xwiki-commons-xml is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect...

CVE-2023-31126: Improper Neutralization of Invalid Characters in Identifiers in Web Pages

org.xwiki.commons:xwiki-commons-xml is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect...

PT-2023-8607 · Xwiki · Xwiki-Commons-Xml

Name of the Vulnerable Software and Affected Versions: org.xwiki.commons:xwiki-commons-xml versions 14.6-rc-1 through 14.10.3 org.xwiki.commons:xwiki-commons-xml versions prior to 15.0 RC1 Description: The HTML sanitizer in the org.xwiki.commons:xwiki-commons-xml library allows the injection of...

org.xwiki.commons:xwiki-commons-diff-script (>=11.6-rc-1, <=14.9), org.xwiki.commons:xwiki-commons-diff-xml (>=11.6-rc-1, <=14.9) +57 more potentially affected by CVE-2023-29528 via org.xwiki.commons:xwiki-commons-xml (>=4.2-milestone-1, <=14.9)

org.xwiki.commons:xwiki-commons-xml MAVEN version =4.2-milestone-1, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =14.8-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-3, =4.2-milestone-1, =14.8-rc-1,...

org.xwiki.commons:xwiki-commons-diff-script (>=11.6-rc-1, <=14.9), org.xwiki.commons:xwiki-commons-diff-xml (>=11.6-rc-1, <=14.9) +57 more potentially affected by CVE-2023-29528 via org.xwiki.commons:xwiki-commons-xml (>=4.2-milestone-1, <=14.9)

org.xwiki.commons:xwiki-commons-xml MAVEN version =4.2-milestone-1, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =14.8-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-3, =4.2-milestone-1, =14.8-rc-1,...

org.xwiki.commons:xwiki-commons-diff-script (>=11.6-rc-1, <=14.5), org.xwiki.commons:xwiki-commons-diff-xml (>=11.6-rc-1, <=14.5) +54 more potentially affected by CVE-2023-29201 via org.xwiki.commons:xwiki-commons-xml (>=4.2-milestone-1, <=14.5)

org.xwiki.commons:xwiki-commons-xml MAVEN version =4.2-milestone-1, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-3, =4.2-milestone-1, =4.2-milestone-1,...

org.xwiki.commons:xwiki-commons-diff-script (>=11.6-rc-1, <=14.5), org.xwiki.commons:xwiki-commons-diff-xml (>=11.6-rc-1, <=14.5) +54 more potentially affected by CVE-2023-29201 via org.xwiki.commons:xwiki-commons-xml (>=4.2-milestone-1, <=14.5)

org.xwiki.commons:xwiki-commons-xml MAVEN version =4.2-milestone-1, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-3, =4.2-milestone-1, =4.2-milestone-1,...

org.xwiki.commons:xwiki-commons-diff-script (>=14.5, <=14.6), org.xwiki.commons:xwiki-commons-diff-xml (>=14.5, <=14.6) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.5, <=14.6)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.6 and more Source cves: CVE-2023-26055 Source advisory: GHSA-8CW6-4R32-6R3H...

org.xwiki.commons:xwiki-commons-diff-script (>=14.0-rc-1, <=14.4.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.0-rc-1, <=14.4.3) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.0-rc-1, <=14.4.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.4.3 and more Source cves: CVE-2023-26055 Source...

org.wikbook:wikbook.maven (>=0.9.33, <=0.9.45), org.wikbook:wikbook.xwiki (>=0.9.33, <=0.9.45) +57 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=3.2-milestone-3, <=13.10.8)

org.xwiki.commons:xwiki-commons-xml MAVEN version =3.2-milestone-3, =0.9.33, =0.9.33, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =3.2-milestone-3, =3.2-milestone-3, =4.1-milestone-1, =3.2-milestone-3, =3.2-milestone-3, =4.2-milestone-3, =4.1-milestone-2,...

org.xwiki.commons:xwiki-commons-diff-script (>=14.5, <=14.6), org.xwiki.commons:xwiki-commons-diff-xml (>=14.5, <=14.6) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.5, <=14.6)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.6 and more Source cves: CVE-2023-26055 Source advisory: OSV:GHSA-8CW6-4R32-6R3H...