Critical · published April 16, 2023
CVSS calls it critical at 10.0. It sits in the 99.5th percentile for exploit probability.
🚨 An unsuspecting user with view rights can unleash a code execution frenzy! This CVE lets anyone run arbitrary Groovy, Python, or Velocity scripts in XWiki, leading to full system access. 🔥 Think of it like a hotel with open access to its documents. Anyone with a basic key can stroll in and use the hotel's facilities to host their own wild party, completely disregarding the rules. That's the same way this vulnerability allows code execution without any additional checks. With this vulnerability, an attacker could not only view documents but also execute full-on scripts, gaining complete control over your XWiki installation. That means they could manipulate data, view sensitive information, or even disrupt services. The potential fallout could be absolutely devastating!
Think of it like a hotel with open access to its documents. Anyone with a basic key can stroll in and use the hotel's facilities to host their own wild party, completely disregarding the rules. That's the same way this vulnerability allows code execution without any additional checks. This vulnerability arises due to improper escaping of parameters in the `documentTree` macro, enabling users to run arbitrary code in a default-installed page. The flaw affects XWiki Commons, which many XWiki projects rely on.
With this vulnerability, an attacker could not only view documents but also execute full-on scripts, gaining complete control over your XWiki installation. That means they could manipulate data, view sensitive information, or even disrupt services. The potential fallout could be absolutely devastating! To mitigate this risk, upgrade to XWiki versions 13.10.11, 14.4.7, or 14.10 immediately. Ensure that macros are properly configured and restrict view rights to sensitive documents to safeguard against unauthorized access. Regularly audit your XWiki configurations! You've got this! By following these steps, you'll reinforce your defenses and keep your installation secure. 🛡️