Critical · published June 29, 2023
🚨 Just when you thought upgrading your XWiki installation fixed everything, a sneaky old vulnerability can still rear its ugly head! 🔥 Think of upgrading your XWiki like renovating a restaurant — you spruce up the dining area but forget to throw out the spoiled leftovers in the kitchen. Those old revisions are still hanging around, ready to serve up a nasty surprise. An attacker could exploit this vulnerability to execute remote code, potentially compromising the entire XWiki installation. This means they could access sensitive data, modify content, or even take full control of your wiki — a nightmare that can lead to significant data loss and integrity issues!
Think of upgrading your XWiki like renovating a restaurant — you spruce up the dining area but forget to throw out the spoiled leftovers in the kitchen. Those old revisions are still hanging around, ready to serve up a nasty surprise. The vulnerability arises because XWiki retains old document revisions even after upgrades, allowing attackers to reproduce exploits from fixed vulnerabilities by simply adding a revision parameter to the URL. This means even after updating to a secure version, certain exploits can still be executed with just view rights.
An attacker could exploit this vulnerability to execute remote code, potentially compromising the entire XWiki installation. This means they could access sensitive data, modify content, or even take full control of your wiki — a nightmare that can lead to significant data loss and integrity issues! To safeguard your XWiki, upgrade to 14.10.7 or 15.2RC1, where old revisions are executed in a restricted mode. As an extra line of defense, manually delete old revisions of affected documents — a script can aid in this process, but be vigilant, as it’s easy to overlook some vulnerable documents! You've got this! With these steps, you can secure your XWiki and keep those pesky vulnerabilities at bay! 🛡️