Critical · published April 16, 2023
🚨 A user with the `WikiManager.DeleteWiki` permission can execute any Groovy, Python, or Velocity code, potentially compromising the entire XWiki installation! 🔥 Think of it like handing someone a master key to your entire library, allowing them to read, modify, or even delete any book they want without permission. That's how this improper escaping of the `wikiId` parameter can let an attacker run wild with code! An attacker could exploit this vulnerability to gain full control over the XWiki installation—think reading sensitive documents, altering pages, or deleting content entirely. The consequences could be absolutely devastating for any organization relying on this system, leading to data loss and reputational damage!
Think of it like handing someone a master key to your entire library, allowing them to read, modify, or even delete any book they want without permission. That's how this improper escaping of the `wikiId` parameter can let an attacker run wild with code! This vulnerability arises from improper escaping of the `wikiId` URL parameter, allowing a user with specific permissions to inject and execute arbitrary code within the XWiki environment.
An attacker could exploit this vulnerability to gain full control over the XWiki installation—think reading sensitive documents, altering pages, or deleting content entirely. The consequences could be absolutely devastating for any organization relying on this system, leading to data loss and reputational damage! Patch your XWiki installation immediately to version 13.10.11, 14.4.7, or 14.10 to close this critical vulnerability. Additionally, review user permissions to ensure that only trusted users have access to `WikiManager.DeleteWiki` rights. 🛡️ You've got this! By taking these quick actions, you’ll tighten your defenses and protect your XWiki installation. 💪✨