Critical · published May 9, 2023
CVSS calls it critical at 9.1. It sits in the 99.4th percentile for exploit probability.
🚨 A simple URL is the gateway to running JavaScript with any user's rights on XWiki — imagine the chaos that could ensue! 😱 It's like giving a hotel guest a magic key that opens every room in the building, allowing them to snoop around without anyone being the wiser. Just one misdirected click leads to a world of trouble! An attacker could exploit this vulnerability to execute malicious scripts, potentially hijacking user sessions, stealing sensitive data, or defacing the wiki. With the ability to run JavaScript with the permissions of any user, the risks escalate from simple pranks to serious breaches of privacy and security.
It's like giving a hotel guest a magic key that opens every room in the building, allowing them to snoop around without anyone being the wiser. Just one misdirected click leads to a world of trouble! This vulnerability allows for cross-site scripting (XSS) by leading a user to a specially crafted URL targeting a page with attachments. The flaw exists in XWiki versions 2.2-milestone-1 and prior to 14.4.8, 14.10.4, and 15.0-rc-1, where it fails to properly validate input before executing JavaScript.
An attacker could exploit this vulnerability to execute malicious scripts, potentially hijacking user sessions, stealing sensitive data, or defacing the wiki. With the ability to run JavaScript with the permissions of any user, the risks escalate from simple pranks to serious breaches of privacy and security. Update to XWiki versions 15.0-rc-1, 14.10.4, or 14.4.8 immediately! If an immediate upgrade isn’t feasible, you can apply a temporary fix by modifying the `<xwiki app>/templates/importinline.vm` file as indicated in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01. Be proactive about your wiki's security! You've got this! By following these steps, you'll keep your XWiki safe and sound! 🛡️