This has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags. The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags.
Xwiki commons is the common modules used by other XWiki top level projects. The email package is intended to have size limits and to throw an exception when limits are exceeded they were exceeded by the example demonstration code. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. Applications should instead use the or class.
NOTE: is categorized as a Legacy API in the documentation of the Python email package. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. ** DISPUTED ** The legacy function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument.
0 kommentar(er)
