Critical · published October 25, 2023
🚨 An unsuspecting wiki user can unleash chaos with just a tweak! This critical vulnerability in XWiki allows anyone who can edit their own profile to run arbitrary scripts, like a chef throwing in surprise ingredients without warning. 🔥 Think of it like a restaurant where patrons can secretly swap the chef's ingredients in the kitchen — one incorrect change could lead to disaster in the menu! If exploited, an attacker could gain unrestricted read and write access to all wiki contents, allowing them to manipulate or destroy valuable data at will. This could lead to a complete compromise of the wiki, leaving your organization vulnerable to data leaks or loss.
Think of it like a restaurant where patrons can secretly swap the chef's ingredients in the kitchen — one incorrect change could lead to disaster in the menu! This vulnerability allows users to execute arbitrary Groovy and Python macros by editing their own user profiles, bypassing normal security checks. The flaw exists in XWiki versions 5.1-rc-1 through 14.10.7 and 15.3-rc-1, which fail to properly escape user inputs.
If exploited, an attacker could gain unrestricted read and write access to all wiki contents, allowing them to manipulate or destroy valuable data at will. This could lead to a complete compromise of the wiki, leaving your organization vulnerable to data leaks or loss. To secure your XWiki installation, update to versions 14.10.8 or 15.3-rc-1 immediately. Alternatively, you can manually patch the vulnerability by modifying just three lines in the `Menu.UIExtensionSheet` document. Don’t wait on this — it's critical! You've got this! With these simple steps, you'll fortify your wiki and keep your data safe. 🛡️