Описание
XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.
Ссылки
- Patch
- PatchVendor Advisory
- Vendor Advisory
- Patch
- PatchVendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 14.5 (включая)
Одно из
cpe:2.3:a:xwiki:rendering:3.0:milestone_2:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
EPSS
Процентиль: 90%
0.05393
Низкий
9 Critical
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-83
CWE-79
CWE-79
Связанные уязвимости
CVSS3: 9
github
больше 2 лет назад
Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
EPSS
Процентиль: 90%
0.05393
Низкий
9 Critical
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-83
CWE-79
CWE-79