Critical · published April 18, 2023
🚨 If you have edit rights on a page, you're holding a golden key to execute arbitrary code in XWiki! 🔥 Think of it like having access to a hotel room where you can rearrange all the furniture and change the locks — once you're in, you have total control! An attacker could potentially run any Groovy, Python, or Velocity code they desire, leading to full access to the XWiki installation. This could allow for data theft, unauthorized changes, or even the complete takeover of the wiki environment, which would be a nightmare for any organization!
Think of it like having access to a hotel room where you can rearrange all the furniture and change the locks — once you're in, you have total control! The vulnerability stems from improper escaping of information loaded from attachments in the default pages `imported.vm`, `importinline.vm`, and `packagelist.vm`, allowing code execution when a user with edit rights interacts with them.
An attacker could potentially run any Groovy, Python, or Velocity code they desire, leading to full access to the XWiki installation. This could allow for data theft, unauthorized changes, or even the complete takeover of the wiki environment, which would be a nightmare for any organization! Upgrade XWiki to the latest versions: 15.0-rc-1, 14.10.1, 14.4.8, or 13.10.11 immediately! There are no known workarounds, so make sure to act quickly to avoid potential exploitation. You've got this! With these updates, you’ll lock down your XWiki and keep those pesky intruders out! 🛡️