Critical · published April 10, 2024
CVSS calls it critical at 10.0. It sits in the 99.5th percentile for exploit probability.
🚨 A crafty edit on any page could unlock full server control! Users with edit rights in XWiki can sneak in dangerous code—like a mischievous chef slipping in a secret ingredient! 🔥 Think of it like a restaurant where customers have the ability to change the menu without the chef's approval. If someone were to add a dish with mystery ingredients, it could ruin the entire dining experience for everyone! An attacker could execute malicious code on the server, jeopardizing the confidentiality, integrity, and availability of the entire XWiki installation. This could lead to unauthorized data access, tampering of content, or even a complete system takeover, making it absolutely devastating!
Think of it like a restaurant where customers have the ability to change the menu without the chef's approval. If someone were to add a dish with mystery ingredients, it could ruin the entire dining experience for everyone! This vulnerability occurs in XWiki versions 5.0-rc-1 to 15.5.3 and allows users with edit rights to add an object of type `XWiki.SearchSuggestSourceClass` to their profiles or pages, enabling them to run arbitrary code on the server.
An attacker could execute malicious code on the server, jeopardizing the confidentiality, integrity, and availability of the entire XWiki installation. This could lead to unauthorized data access, tampering of content, or even a complete system takeover, making it absolutely devastating! Upgrade to XWiki versions 14.10.20, 15.5.4, or 15.10 RC1 immediately. If you can't upgrade right away, manually apply the patch to the `XWiki.SearchSuggestSourceSheet` document to mitigate this risk. Don't wait—act fast! You've got this! With these steps, you'll fortify your installation and keep your XWiki safe. 🛡️