XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the administration interface. This impacts the confidentiality, integrity and availability of the whole XWiki installation. Normally, all users are allowed to edit their own user profile so this should be exploitable by all users of the XWiki instance. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1. The patches can be manually applied to the `XWiki.ConfigurableClassMacros` and `XWiki.ConfigurableClass` pages.
The code responsible for displaying sections in the XWiki administrative interface lacks proper escaping of input data (CWE-94, CWE-95). An attacker can inject malicious code into the editable content of a wiki page, which will then be executed with programming rights. The vulnerability affects the pages `XWiki.ConfigurableClassMacros` and `XWiki.ConfigurableClass` and can be exploited remotely without special privileges — it is sufficient to have the ability to edit any page, such as one's own user profile.
An attacker can obtain full programming rights in an XWiki installation, leading to a breach of confidentiality, integrity, and availability of the entire instance — including the possibility of taking control of the platform.
XWiki Platform should be updated to version 14.10.15, 15.5.2, or 15.7RC1. Alternatively, it is possible to manually apply patches directly to the pages `XWiki.ConfigurableClassMacros` and `XWiki.ConfigurableClass` in accordance with the commits indicated in the vendor's references.
XWiki Platform in versions from 2.3 to (not including) 14.10.15, 15.5.2, and 15.7-rc-1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HXwiki
APPXwiki15.615.72.3 – 14.10.5 (bez)15.0 – 15.5.2 (bez)
Related vulnerabilities
XWiki Platform — niezautoryzowany RCE przez endpoint SolrSearch
XWiki Platform — path traversal umożliwia odczyt plików konfiguracyjnych
XWiki Platform: ujawnienie plików konfiguracyjnych przez webjars API (path traversal)
SQL Injection w XWiki Platform via parametr sort w getdeleteddocuments.vm
XWiki Rendering: bypass trybu restricted przez zagnieżdżone makra