Critical · published April 18, 2023
🚨 A simple click is all it takes for a user with view rights to unleash Groovy, Python, or Velocity chaos in XWiki! 🔥 Think of it like a restaurant where patrons can order anything off the secret menu without even needing a chef's special approval — they could request the most outrageous dishes and completely overrun the kitchen! 🍽️ This vulnerability allows anyone with view access to execute arbitrary code, potentially leading to full control of your XWiki installation. An attacker could steal sensitive data, change settings, or even delete all your carefully curated content, making it an absolute nightmare for any admin! 😱
Think of it like a restaurant where patrons can order anything off the secret menu without even needing a chef's special approval — they could request the most outrageous dishes and completely overrun the kitchen! 🍽️ The flaw stems from improper escaping in the `Invitation.InvitationCommon` page, which is installed by default in XWiki. This oversight permits unauthorized code execution by users who shouldn't have such powers!
This vulnerability allows anyone with view access to execute arbitrary code, potentially leading to full control of your XWiki installation. An attacker could steal sensitive data, change settings, or even delete all your carefully curated content, making it an absolute nightmare for any admin! 😱 Upgrade to XWiki versions 15.0-rc-1, 14.10.1, 14.4.8, or 13.10.11 to patch this vulnerability immediately. It's crucial to ensure that any user with view rights is aware of this issue before the fix is applied, as there are no known workarounds! 🛡️ You've got this! Follow these steps, and you’ll have your XWiki fortress secured in no time! 💪✨