XWiki allows remote code execution through preview of XClass changes in AWM editor

Impact Any XWiki user with edit right on at least one App Within Minutes application the default for all users XWiki can obtain programming right/perform remote code execution by editing the application. The detailed reproduction steps can be found in the original bug report. Patches This...

CVE-2023-36477

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing technical documents, leading to loss of...