Critical · published November 23, 2022
🚨 A user with just view rights can execute arbitrary code in XWiki—like handing out a master key to the entire building! 🔥 Think of XWiki as a community kitchen where anyone can cook if they have access. If the menu is poorly safeguarded, an untrustworthy chef could whip up anything, even harmful dishes, potentially poisoning everyone. 🍽️ This flaw could allow an attacker to run any code they want, leading to full control over the XWiki installation. Imagine the chaos if an unauthorized person reprograms the recipes or even locks everyone out of the kitchen altogether! 😱
Think of XWiki as a community kitchen where anyone can cook if they have access. If the menu is poorly safeguarded, an untrustworthy chef could whip up anything, even harmful dishes, potentially poisoning everyone. 🍽️ The vulnerability arises from improper escaping of macro content in the menu macro, allowing users with view rights to execute Groovy, Python, or Velocity code. This means a simple view can turn into a dangerous command execution scenario.
This flaw could allow an attacker to run any code they want, leading to full control over the XWiki installation. Imagine the chaos if an unauthorized person reprograms the recipes or even locks everyone out of the kitchen altogether! 😱 To protect your installation, patch immediately to XWiki versions 14.6RC1, 13.10.8, or 14.4.3. If you're using version 11.6 or later, you can apply the relevant patch manually or import a patched XAR archive. Don’t delay—secure your kitchen! 🛡️ You've got this! By applying the patch, you'll restore safety to your XWiki environment in no time. 🎉