Critical · published April 16, 2023
🚨 Any user with edit rights can run arbitrary Groovy, Python, or Velocity code in XWiki, opening the door to full access — that’s a massive security risk! 🔥 Think of it like a restaurant where anyone who has permission to rearrange the tables can also sneak into the kitchen and cook whatever they like. If someone can edit pages, they can also whip up a recipe for disaster! This vulnerability allows attackers to execute any code they want, potentially leading to complete control over the XWiki installation. This could mean accessing sensitive data, altering content, or playing havoc with the entire system — a nightmare for any organization!
Think of it like a restaurant where anyone who has permission to rearrange the tables can also sneak into the kitchen and cook whatever they like. If someone can edit pages, they can also whip up a recipe for disaster! The root cause stems from improper escaping of section IDs in `XWiki.AdminFieldsDisplaySheet`, which is installed by default. This flaw permits users with edit rights to execute arbitrary code within the platform.
This vulnerability allows attackers to execute any code they want, potentially leading to complete control over the XWiki installation. This could mean accessing sensitive data, altering content, or playing havoc with the entire system — a nightmare for any organization! Immediately upgrade to XWiki versions 15.0-rc-1, 14.10.1, 14.4.8, or 13.10.11. After upgrading, review user permissions to ensure only trusted individuals have edit rights. You’ve got this! By following these steps, you’ll significantly strengthen your XWiki security! 🛡️