XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest

Impact XWiki doesn't properly escape the section URL parameter that is used in the code for displaying administration sections. This allows any user with read access to the document XWiki.AdminSheet by default, everyone including unauthenticated users to execute code including Groovy code. This...

CVE-2023-46731 Remote code execution through the section parameter in Administration as guest in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL parameter that is used in the code for displaying administration sections. This allows any user with read access to the document XWiki.AdminSheet ...

CVE-2023-46731

XWiki Platform is affected by a remote code execution (RCE) vulnerability stemming from improper escaping of the section URL parameter in the administration UI (XWiki.AdminSheet). With read access, including unauthenticated users, an attacker can inject and execute Groovy code, impacting confiden...