org.xwiki.commons:xwiki-commons-xml@14.10.4 vulnerabilities

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') due to allowing an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet. The attacker can add a malicious input that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form).

Note:

The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document.

Upgrade org.xwiki.commons:xwiki-commons-xml to version 14.10.6, 15.2-rc-1 or higher.