Description

XWiki Platform before 12.8 mishandles escaping in the property displayer.

Remediation

References

https://cve.nstsec.com/cve-2020-13654

https://github.com/xwiki/xwiki-platform/compare/xwiki-platform-12.7.1...xwiki-platform-12.8

https://github.com/xwiki/xwiki-platform/pull/1315

https://jira.xwiki.org/browse/XWIKI-17374

Related Vulnerabilities

CVE-2021-30074 Vulnerability in npm package docsify

CVE-2017-16204 Vulnerability in npm package jquey

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.hpprinter

CVE-2023-3691 Vulnerability in maven package org.webjars:layui

CVE-2018-3753 Vulnerability in npm package merge-objects

Severity

High

Classification

CWE-116 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory Issue Tracking Permissions Required