Critical · published May 9, 2023
🚨 An unassuming XWiki document can turn into a launchpad for chaos! Any user with author rights can execute anything, potentially compromising your entire platform! 🔥 Think of it like a restaurant where the head chef can cook anything, but the sous chefs accidentally leave the kitchen door wide open. Anyone who walks in could whip up their own secret recipe without a second thought! This vulnerability could lead to a total takeover of your XWiki instance. An attacker could alter contents, inject malicious code, or even wipe out your entire wiki—just because they had author rights on a single document. The potential for data loss and damage is absolutely devastating!
Think of it like a restaurant where the head chef can cook anything, but the sous chefs accidentally leave the kitchen door wide open. Anyone who walks in could whip up their own secret recipe without a second thought! In XWiki versions 3.3-milestone-2 to 14.10.3 and 15.0-rc-1, an insufficient check allows any user with author rights on the XWiki.ClassSheet document to execute arbitrary actions, leading to full control over the platform.
This vulnerability could lead to a total takeover of your XWiki instance. An attacker could alter contents, inject malicious code, or even wipe out your entire wiki—just because they had author rights on a single document. The potential for data loss and damage is absolutely devastating! Immediate action is required! Upgrade to XWiki 14.10.4 or 15.0-rc-1 to patch this vulnerability. Ensure all users with author rights are reviewed to prevent unauthorized actions in the future. You've got this! Follow these steps, and you’ll lock down your XWiki like a pro. 🛡️