| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-invitation-ui | ≥ 14.5, < 14.10.6≥ 15.0-rc-1, < 15.2-rc-1≥ 2.5-m-1, < 14.4.8 | 14.10.615.2-rc-114.4.8 |
| xwiki | ≥ 14.5.0, < 14.10.6≥ 15.0, < 15.2≥ 2.5, < 14.4.8 | 14.10.615.214.4.8 |
Any user who can view Invitation.WebHome can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This can be reproduced with the following steps:
{{cache}}{{groovy}}new File("/tmp/exploit.txt").withWriter { out -> out.println("Attacked from invitation!"); }{{/groovy}}{{/cache}}The vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6.
The vulnerability can be patched manually by applying the patch on Invitation.InvitationCommon and Invitation.InvitationConfig.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free