Critical · published October 25, 2023
🚨 A crafty error message is the gateway here! XWiki's failure to escape HTML in its error feedback could let attackers inject nasty scripts through documents they control. 🔥 Think of it like a restaurant kitchen that quietly accepts any food order without checking the ingredients list — if someone sneaks in a dangerous allergen disguised as a recipe name, it could ruin dinner for everyone! An attacker can exploit this vulnerability to execute arbitrary scripts in the context of other users' browsers, potentially leading to data theft or unauthorized actions. This isn't just a minor glitch; it's a critical flaw that could compromise the trust and safety of your wiki community.
Think of it like a restaurant kitchen that quietly accepts any food order without checking the ingredients list — if someone sneaks in a dangerous allergen disguised as a recipe name, it could ruin dinner for everyone! This cross-site scripting (XSS) vulnerability arises because XWiki fails to properly escape error messages when attempting to create documents with names that include malicious code. Attackers must create a document containing the exploit code first, which makes it a bit sneaky, but very dangerous!
An attacker can exploit this vulnerability to execute arbitrary scripts in the context of other users' browsers, potentially leading to data theft or unauthorized actions. This isn't just a minor glitch; it's a critical flaw that could compromise the trust and safety of your wiki community. To protect your XWiki instance, upgrade to `org.xwiki.platform:xwiki-platform-web` version 13.4-rc-1 or higher, and for templates, ensure you are on versions 14.10.12 or 15.5-rc-1. If immediate patching isn't possible, manually apply the necessary changes to the `createinline.vm` file in your WAR package. 🛡️ You've got this! Follow these steps, and your XWiki will be safer in no time. Keep being the security hero you are! 💪✨