Known vulnerabilities in the org.xwiki.commons:xwiki-commons-xml package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
C Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) such that the `restricted` mode of the HTML cleaner in XWiki, allowed the injection of arbitrary HTML code via invalid HTML comments. When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. How to fix Cross-site Scripting (XSS)? Upgrade `org.xwiki.commons:xwiki-commons-xml` to version 14.10 or higher.	[4.2-milestone-1,14.10)
H Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization when using the "restricted" mode of the HTML cleaner. Exploiting this vulnerability is possible when a privileged user with programming rights visits such a maliciously crafted comment in XWiki, the malicious JavaScript code is executed in the context of the user session. How to fix Cross-site Scripting (XSS)? Upgrade `org.xwiki.commons:xwiki-commons-xml` to version 14.6-rc-1 or higher.	[4.2-milestone-1,14.6-rc-1)

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) such that the restricted mode of the HTML cleaner in XWiki, allowed the injection of arbitrary HTML code via invalid HTML comments. When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session.

How to fix Cross-site Scripting (XSS)?

Upgrade org.xwiki.commons:xwiki-commons-xml to version 14.10 or higher.

[4.2-milestone-1,14.10)

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization when using the "restricted" mode of the HTML cleaner. Exploiting this vulnerability is possible when a privileged user with programming rights visits such a maliciously crafted comment in XWiki, the malicious JavaScript code is executed in the context of the user session.

How to fix Cross-site Scripting (XSS)?

Upgrade org.xwiki.commons:xwiki-commons-xml to version 14.6-rc-1 or higher.

[4.2-milestone-1,14.6-rc-1)

Go back to all versions of this package