CVE-2023-31126— Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-31126
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml
Source: NVD (National Vulnerability Database)
Vulnerability Description
`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect restricted cleaning in HTMLCleaner as there attributes are cleaned and thus characters like `/` and `>` are removed in all attribute names. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by making sure that data attributes only contain allowed characters. There are no known workarounds apart from upgrading to a version including the fix.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
Web页面标识中非法字符转义处理不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
XWiki Platform 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Platform是法国XWiki基金会的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 14.6-rc-1到14.10.4版本存在安全漏洞，该漏洞源于HTML 元素清理器会接受无效数据属性，允许跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-commons | >= 14.6-rc-1, < 14.10.4 | - |
II. Public POCs for CVE-2023-31126
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/shoucheng3/xwiki__xwiki-commons_CVE-2023-31126_14-10-3 | POC Details |
| 2 | XWiki Commons CVE-2023-31126 v14.10.3 for Coverity analysis | https://github.com/shoucheng3/cov-int | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-31126
请登录查看更多情报信息。
- https://jira.xwiki.org/browse/XCOMMONS-2606x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2023-31126
Same Patch Batch · xwiki · 2023-05-09 · 3 CVEs total
| CVE-2023-32069 | 10.0 CRITICAL | XWiki Platform privilege escalation (PR)/RCE from account through class sheet |
| CVE-2023-32071 | 9.1 CRITICAL | XWiki Platform vulnerable to RXSS via editor parameter - importinline template |
IV. Related Vulnerabilities
Same product: xwiki-commons
- CVE-2024-31996
XWiki Commons missing escaping of `{` in Velocity escapetool - CVE-2023-36471
HTML sanitizer allows form elements in restricted in org.xwi - CVE-2023-29528
Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml - CVE-2023-29201
org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vul - CVE-2023-26055
XWiki Commons may allow privilege escalation to programming
Same vendor: xwiki
- CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h - CVE-2026-40104
XWiki's REST APIs can list all pages/spaces, leading to unav - CVE-2026-33229
XWiki Platform affected by remote code execution with script - CVE-2026-26000
XWiki Platform affected by click-jacking through CSS injecti - CVE-2026-24128
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Er
Same weakness: CWE-86
- CVE-2026-28417
Vim has OS Command Injection in netrw - CVE-2025-66606
Yokogawa FAST/TOOLS 安全漏洞 - CVE-2025-20168
Cisco Common Services Platform Collector Cross-Site Scriptin - CVE-2025-20167
Cisco Common Services Platform Collector Cross-Site Scriptin - CVE-2025-20166
Cisco Common Services Platform Collector Cross-Site Scriptin
V. Comments for CVE-2023-31126
Anonymous User
2025-08-25 09:40:15katana