Critical · published September 8, 2022
CVSS calls it critical at 9.9. It sits in the 99.5th percentile for exploit probability.
🚨 It’s possible to inject arbitrary code into your XWiki installation just by having view access! 🔥 Think of this like a restaurant where the menu is wide open, letting any customer scribble extra ingredients onto their order—no one checks what’s in those scribbles. That’s how easy it is for an attacker to slip in malicious scripts if they can access an affected page! An attacker could exploit this vulnerability to run arbitrary Groovy, Python, or Velocity code, allowing them to bypass all security checks. They could modify, disclose, or even disrupt the entire wiki’s content, leading to potentially devastating consequences for your data and service availability!
Think of this like a restaurant where the menu is wide open, letting any customer scribble extra ingredients onto their order—no one checks what’s in those scribbles. That’s how easy it is for an attacker to slip in malicious scripts if they can access an affected page! This vulnerability in XWiki allows users with view access to inject malicious scripts through URL parameters using the `XWikiServerClassSheet`. This enables attackers to execute arbitrary code, impacting permissions and access controls.
An attacker could exploit this vulnerability to run arbitrary Groovy, Python, or Velocity code, allowing them to bypass all security checks. They could modify, disclose, or even disrupt the entire wiki’s content, leading to potentially devastating consequences for your data and service availability! Immediately update your XWiki installations to versions 13.10.6 or 14.4 to patch this vulnerability. If updating isn't possible right away, manually edit the affected documents or import from a non-vulnerable version as a temporary workaround. Don’t wait—act now! You’ve got this! With these steps, your XWiki is on the path to becoming secure again. 🛡️