CVE-2023-31126

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-31126
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31126.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-31126
Aliases
Published
2023-05-09T13:15:18Z
Modified
2024-06-06T14:22:33.413227Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

org.xwiki.commons:xwiki-commons-xml is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect restricted cleaning in HTMLCleaner as there attributes are cleaned and thus characters like / and > are removed in all attribute names. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by making sure that data attributes only contain allowed characters. There are no known workarounds apart from upgrading to a version including the fix.

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0b8e9c45b7e7457043938f35265b2aa5adc76a68
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
188d77c1a421e64ba71e2c3189e585e1fc54ac92
Fixed
c127075e7814ef7cd164bb6493d67b1943b6db1e

Affected versions

xwiki-commons-7.*

xwiki-commons-7.3-milestone-2
xwiki-commons-7.4-milestone-1
xwiki-commons-7.4-milestone-2

xwiki-commons-8.*

xwiki-commons-8.0-milestone-1
xwiki-commons-8.0-milestone-2
xwiki-commons-8.1-milestone-1
xwiki-commons-8.1-milestone-2
xwiki-commons-8.2-milestone-1
xwiki-commons-8.2-milestone-2
xwiki-commons-8.3-milestone-1
xwiki-commons-8.3-milestone-2