Cross-Site Scripting (XSS)

2023-05-1501:40:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

xwiki

vulnerability

cross-site scripting

xss

attacks

html rendering

javascript

browser

security

0.001 Low

EPSS

Percentile

37.4%

JSON

XWiki is vulnerable to Cross-Site Scripting (XSS) attacks. The library does not properly check for dangerous attribute values in HTML rendering before it output to the front end, allowing an attacker to inject and execute malicious JavaScript on victim’s browser.

CPENameOperatorVersion
xwiki rendering - macro - htmlle11.3.7
xwiki rendering - macro - htmlle14.5
xwiki rendering - syntax - annotated html5le14.5
xwiki rendering - syntax - annotated xhtmlle14.5
xwiki rendering - syntax - html5le7.0.1
xwiki rendering - syntax - html5le14.5
xwiki rendering - syntax - xhtmlle14.5
xwiki rendering - xmlle14.5
xwiki rendering - macro - htmlle11.3.7
xwiki rendering - macro - htmlle14.5

Name	Operator	Version
xwiki rendering - macro - html	le	11.3.7
xwiki rendering - macro - html	le	14.5
xwiki rendering - syntax - annotated html5	le	14.5
xwiki rendering - syntax - annotated xhtml	le	14.5
xwiki rendering - syntax - html5	le	7.0.1
xwiki rendering - syntax - html5	le	14.5
xwiki rendering - syntax - xhtml	le	14.5
xwiki rendering - xml	le	14.5
xwiki rendering - macro - html	le	11.3.7
xwiki rendering - macro - html	le	14.5