Critical · published July 14, 2023
CVSS calls it critical at 10.0. It sits in the 99.8th percentile for exploit probability.
🔥 An improper escape in XWiki could let a crafty user turn a harmless page into a playground for malicious scripts! Think of it like a hotel guest who finds a way to sneak into the penthouse by disguising the room number — one clever manipulation opens the door to the entire floor! 🏨 An attacker could execute arbitrary scripts, gaining unrestricted access to all wiki contents, which is absolutely devastating! They could read sensitive documents, modify everything, or even delete crucial information — a nightmare scenario for any organization.
Think of it like a hotel guest who finds a way to sneak into the penthouse by disguising the room number — one clever manipulation opens the door to the entire floor! 🏨 This vulnerability exists due to improper escaping in the document `SkinsCode.XWikiSkinsSheet`, allowing attackers to use crafted page names to inject and execute scripts, including Groovy and Python macros, on the server.
An attacker could execute arbitrary scripts, gaining unrestricted access to all wiki contents, which is absolutely devastating! They could read sensitive documents, modify everything, or even delete crucial information — a nightmare scenario for any organization. Upgrade to XWiki version 14.4.8, 14.10.4, or 15.0-rc-1 immediately to patch this vulnerability. If upgrading isn’t feasible, manually apply the fix from commit `d9c88ddc` to the impacted document to secure your installation. You’ve got this! Address this vulnerability today and keep your wiki safe! 🛡️