Critical · published August 17, 2023
🚨 Anyone who can peek at `Invitation.WebHome` can run arbitrary Groovy and Python scripts! This is a gateway to remote code execution with full access to your wiki's treasures! 🔥 Think of it like a guest at a party who not only gets to snoop around the house but can also rearrange the furniture and change the music playlist without asking. That's how invasive this vulnerability is for your XWiki! An attacker with access to this page could execute their scripts freely, leading to unrestricted read and write access to all wiki content. This could mean leaking sensitive information or even rewriting critical documents — a nightmare scenario for any organization!
Think of it like a guest at a party who not only gets to snoop around the house but can also rearrange the furniture and change the music playlist without asking. That's how invasive this vulnerability is for your XWiki! This vulnerability in XWiki Platform allows any user who can view the `Invitation.WebHome` page to execute scripts through Groovy and Python macros, resulting in potential remote code execution.
An attacker with access to this page could execute their scripts freely, leading to unrestricted read and write access to all wiki content. This could mean leaking sensitive information or even rewriting critical documents — a nightmare scenario for any organization! Upgrade your XWiki to versions 14.4.8, 15.2-rc-1, or 14.10.6 immediately to patch this vulnerability. If upgrading isn't possible right now, manually apply the patch on `Invitation.InvitationCommon` and `Invitation.InvitationConfig`. Unfortunately, no workarounds are available — swift action is essential! You've got this! Take these steps, and you'll have your XWiki secured in no time! 🛡️