Homepage

org.xwiki.commons:xwiki-commons-xml@4.1-milestone-1 vulnerabilities

  • latest version

    17.9.0

  • latest non vulnerable version

    17.9.0

  • first published

    14 years ago

  • latest version published

    20 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.xwiki.commons:xwiki-commons-xml package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Improper Neutralization

    Affected versions of this package are vulnerable to Improper Neutralization such that any user can edit their own profile and inject code, which is going to be executed. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field.

    How to fix Improper Neutralization?

    Upgrade org.xwiki.commons:xwiki-commons-xml to version 13.10.9, 14.7-rc-1 or higher.

    [3.1-milestone-1,13.10.9)[14.0-rc-1,14.7-rc-1)
    • M
    XML External Entity (XXE) Injection

    Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. Any user with velocity script permissions can read arbitrary files, directory listing and perform SSRF through the XML script service.

    How to fix XML External Entity (XXE) Injection?

    Upgrade org.xwiki.commons:xwiki-commons-xml to version 12.10.10, 13.4.4, 13.8-rc-1 or higher.

    [,12.10.10)[13.0,13.4.4)[13.5,13.8-rc-1)
    Go back to all versions of this package