Critical · published October 25, 2023
⚠️ XWiki has a sneaky flaw lurking in its page creation form! Users running versions 12.0-rc-1 to 12.10.12 and 15.5-rc-1 could fall victim to a reflected XSS attack — yikes! 🔥 Think of it like a restaurant where the menu allows customers to sneak in their own ingredients without checking — a recipe for disaster! An attacker can slip in malicious code, with all the privileges of the unsuspecting user who clicked the link. This vulnerability can lead to an attacker executing arbitrary commands with the user's rights. If that user has elevated permissions, it could mean game over for your entire XWiki installation, allowing for full read/write access and possibly even remote code execution! Talk about a security nightmare!
Think of it like a restaurant where the menu allows customers to sneak in their own ingredients without checking — a recipe for disaster! An attacker can slip in malicious code, with all the privileges of the unsuspecting user who clicked the link. This reflected cross-site scripting (XSS) vulnerability in XWiki occurs when document names are not properly validated, allowing attackers to inject malicious scripts through the page creation form.
This vulnerability can lead to an attacker executing arbitrary commands with the user's rights. If that user has elevated permissions, it could mean game over for your entire XWiki installation, allowing for full read/write access and possibly even remote code execution! Talk about a security nightmare! To safeguard your installation, patch to XWiki versions 14.10.12 or 15.5-rc-1 to enable proper escaping. If you're stuck on an older version, consider manually applying the changes from the fix to the vulnerable template file `createinline.vm`. Don't wait! You've got this — just follow these steps, and you'll have your XWiki secured in no time! 🛡️