Xwiki Rendering
Monthly
Reflected XSS in XWiki Platform versions 7.0 through 17.7.0 enables attackers to craft malicious URLs that execute arbitrary actions with victim privileges, potentially leading to full installation compromise if the victim holds administrative or programming rights. The vulnerability requires user interaction to trigger and affects multiple version branches across the XWiki and XWiki Rendering products. Patches are available for affected versions, and a manual workaround exists that requires modification of a single line in the logging_macros.vm template without requiring a restart.
Remote code execution in XWiki Rendering versions prior to 16.10.10, 17.4.3, and 17.6.0-rc-1 allows any authenticated user with edit rights-including the ability to edit their own profile-to inject script macros via insufficiently escaped {{/html}} syntax. Successful exploitation enables arbitrary Groovy or Python macro execution, granting full read/write access to all wiki contents. Public exploit code is available (EPSS 1.02%, 62nd percentile), and though not confirmed actively exploited, the low privilege requirement makes immediate patching critical.
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Reflected XSS in XWiki Platform versions 7.0 through 17.7.0 enables attackers to craft malicious URLs that execute arbitrary actions with victim privileges, potentially leading to full installation compromise if the victim holds administrative or programming rights. The vulnerability requires user interaction to trigger and affects multiple version branches across the XWiki and XWiki Rendering products. Patches are available for affected versions, and a manual workaround exists that requires modification of a single line in the logging_macros.vm template without requiring a restart.
Remote code execution in XWiki Rendering versions prior to 16.10.10, 17.4.3, and 17.6.0-rc-1 allows any authenticated user with edit rights-including the ability to edit their own profile-to inject script macros via insufficiently escaped {{/html}} syntax. Successful exploitation enables arbitrary Groovy or Python macro execution, granting full read/write access to all wiki contents. Public exploit code is available (EPSS 1.02%, 62nd percentile), and though not confirmed actively exploited, the low privilege requirement makes immediate patching critical.
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.