GHSA-H7CW-44VP-JQ7H XWiki Platform vulnerable to privilege escalation (PR) from account through TipsPanel

Impact It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. To reproduce: Add an object of type UIExtensionClass Set "Extension Point ID" to org.xwiki.platform.help.tipsPanel Set "Extension ID" to org.xwiki.platform.user.test needs to be...

XWiki Platform vulnerable to privilege escalation (PR) from account through TipsPanel

Impact It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. To reproduce: Add an object of type UIExtensionClass Set "Extension Point ID" to org.xwiki.platform.help.tipsPanel Set "Extension ID" to org.xwiki.platform.user.test needs to be...