We found a possible XSS vector in the WikiManager.JoinWiki
wiki page related to the “requestJoin” field.
The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3.
The easiest workaround is to edit the wiki page WikiManager.JoinWiki
(with wiki editor) and change the line
<input type='hidden' name='requestJoin' value="$!request.requestJoin"/>
into
<input type='hidden' name='requestJoin' value="$escapetool.xml($!request.requestJoin)">
If you have any questions or comments about this advisory: