Xwiki Commons vulnerabilities

CVE-2023-26055 [CRITICAL] CWE-150 CVE-2023-26055: XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in a

CVE-2023-29528 [CRITICAL] CWE-79 CVE-2023-29528: XWiki Commons are technical libraries common to several other top level XWiki projects. The "restric XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any cod

CVE-2023-36471 [MEDIUM] CWE-74 CVE-2023-36471: Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attack

CVE-2022-24898 [MEDIUM] CWE-611 CVE-2022-24898: org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Start org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The prob