| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-help-ui | ≥ 15.0-rc-1, < 15.1-rc-1≥ 8.1-milestone-1, < 14.10.5 | 15.1-rc-114.10.5 |
| xwiki | ≥ 8.1, < 14.10.5 | 14.10.5 |
It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension.
To reproduce:
tip={{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
The groovy macro is executed, after the fix you get an error instead.
This has been patched in XWiki 15.1-rc-1 and 14.10.5.
There are no known workarounds for it.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free