org.xwiki.commons:xwiki-commons-xml 14.6 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.xwiki.commons:xwiki-commons-xml package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
C Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') due to allowing an attacker without `script` right to either create forms that can be used for phishing attacks or also in the context of a sheet. The attacker can add a malicious input that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). Note: The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document. How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')? Upgrade `org.xwiki.commons:xwiki-commons-xml` to version 14.10.6, 15.2-rc-1 or higher.	[14.6-rc-1,14.10.6)[15.0-rc-1,15.2-rc-1)
C Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization via invalid data attributes. Note: This vulnerability does not affect restricted cleaning in HTMLCleaner as there attributes are cleaned and thus characters like `/` and `>` are removed in all attribute names. How to fix Cross-site Scripting (XSS)? Upgrade `org.xwiki.commons:xwiki-commons-xml` to version 14.10.4 or higher.	[14.6-rc-1,14.10.4)
C Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) such that the `restricted` mode of the HTML cleaner in XWiki, allowed the injection of arbitrary HTML code via invalid HTML comments. When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. How to fix Cross-site Scripting (XSS)? Upgrade `org.xwiki.commons:xwiki-commons-xml` to version 14.10 or higher.	[4.2-milestone-1,14.10)
H Improper Neutralization Affected versions of this package are vulnerable to Improper Neutralization such that any user can edit their own profile and inject code, which is going to be executed. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. How to fix Improper Neutralization? Upgrade `org.xwiki.commons:xwiki-commons-xml` to version 13.10.9, 14.7-rc-1 or higher.	[3.1-milestone-1,13.10.9)[14.0-rc-1,14.7-rc-1)

Vulnerability

Vulnerable Version

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') due to allowing an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet. The attacker can add a malicious input that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form).

Note:

The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document.

How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')?

Upgrade org.xwiki.commons:xwiki-commons-xml to version 14.10.6, 15.2-rc-1 or higher.

[14.6-rc-1,14.10.6)[15.0-rc-1,15.2-rc-1)

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization via invalid data attributes.

Note: This vulnerability does not affect restricted cleaning in HTMLCleaner as there attributes are cleaned and thus characters like / and > are removed in all attribute names.

How to fix Cross-site Scripting (XSS)?

Upgrade org.xwiki.commons:xwiki-commons-xml to version 14.10.4 or higher.

[14.6-rc-1,14.10.4)

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) such that the restricted mode of the HTML cleaner in XWiki, allowed the injection of arbitrary HTML code via invalid HTML comments. When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session.

How to fix Cross-site Scripting (XSS)?

Upgrade org.xwiki.commons:xwiki-commons-xml to version 14.10 or higher.

[4.2-milestone-1,14.10)

Improper Neutralization

Affected versions of this package are vulnerable to Improper Neutralization such that any user can edit their own profile and inject code, which is going to be executed. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field.

How to fix Improper Neutralization?

Upgrade org.xwiki.commons:xwiki-commons-xml to version 13.10.9, 14.7-rc-1 or higher.

[3.1-milestone-1,13.10.9)[14.0-rc-1,14.7-rc-1)

org.xwiki.commons:xwiki-commons-xml@14.6 vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package manager

Direct Vulnerabilities

How to fix?