Critical · published April 23, 2025
CVSS calls it critical at 9.3. It sits in the 99.6th percentile for exploit probability.
🚨 An XWiki vulnerability allows remote users to perform blind SQL injections, even if access restrictions are in place! 🔥 Imagine a waiter who can serve any dish from the kitchen, despite the menu restrictions. This SQL injection flaw lets an attacker bypass security controls, like that waiter taking orders for dishes no one is supposed to have! An attacker could potentially access sensitive data such as password hashes and execute harmful commands like updates or deletions. This is particularly critical because it puts your entire database at risk, leading to unauthorized access to confidential information that could devastate your organization!
Imagine a waiter who can serve any dish from the kitchen, despite the menu restrictions. This SQL injection flaw lets an attacker bypass security controls, like that waiter taking orders for dishes no one is supposed to have! This vulnerability enables remote unauthenticated users to escape the HQL execution context, facilitating a blind SQL injection to run arbitrary SQL statements against the backend database, even when access controls are applied.
An attacker could potentially access sensitive data such as password hashes and execute harmful commands like updates or deletions. This is particularly critical because it puts your entire database at risk, leading to unauthorized access to confidential information that could devastate your organization! Upgrade XWiki to at least version 16.10.1, 16.4.6, or 15.10.16 immediately to patch this vulnerability. Remember, there are no known workarounds, so timely action is essential! You've got this! Secure your XWiki and keep your data safe! 🛡️