XWiki Platform vulnerable to code injection from account through AWM view sheet

Impact

Steps to reproduce:

1. As a user without script or programming right, edit your user profile (or any other document) with the wiki editor and add the content {{groovy}}println("Hello " + "from Groovy!"){{/groovy}}
2. Edit the document with the object editor and add an object of type AppWithinMinutes.LiveTableClass (no values need to be set, just save)
3. View the document

Patches

The vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.3.

Workarounds

There is no known workaround.

References

https://jira.xwiki.org/browse/XWIKI-20423

For more information

If you have any questions or comments about this advisory:

• Open an issue in Jira XWiki.org
• Email us at Security Mailing List