Critical · published December 12, 2024
🚨 Any user with script rights can unleash chaos in your XWiki installation! A few keystrokes could lead to complete remote code execution. 🔥 Think of it like a restaurant where anyone with a special badge can order anything from the menu without the chef checking their ID. If they’re crafty, they could get a recipe that poisons the entire kitchen! An attacker could manipulate the system to execute their own code, potentially breaching the confidentiality of your data, tampering with its integrity, or even shutting down availability. This means your entire XWiki could be compromised, leading to a devastating loss of control over your content.
Think of it like a restaurant where anyone with a special badge can order anything from the menu without the chef checking their ID. If they’re crafty, they could get a recipe that poisons the entire kitchen! This vulnerability resides in the XWiki Platform versions 2.3 through 15.10.8 and 16.2.x, allowing users with script rights to create instances of `XWiki.ConfigurableClass`, enabling arbitrary code execution without restriction.
An attacker could manipulate the system to execute their own code, potentially breaching the confidentiality of your data, tampering with its integrity, or even shutting down availability. This means your entire XWiki could be compromised, leading to a devastating loss of control over your content. To protect your installation, upgrade immediately to XWiki versions 15.10.9 or 16.3.0, as these versions contain the necessary patch. Since no workarounds exist, prioritizing this update is essential! You've got this! Stay vigilant and keep your XWiki secure! 🛡️