Critical Eval Injection Vulnerability Discovered in XWiki Platform

What changed

The XWiki Platform has been found to contain a critical eval injection vulnerability that enables any guest user to execute arbitrary code remotely. This flaw poses serious risks to the confidentiality, integrity, and availability of the entire XWiki installation.

The vulnerability has been addressed in recent updates, specifically in versions 15.10.11, 16.4.1, and 16.5.0RC1. Users are strongly encouraged to upgrade to these versions to mitigate the risk.

Who is affected

This vulnerability impacts a wide range of users and organizations utilizing the XWiki Platform for their applications. The following groups are particularly at risk:

Organizations using XWiki for internal documentation or project management may face severe security breaches due to this vulnerability.

• XWiki Platform users and administrators.
• Businesses leveraging XWiki for collaborative projects.
• Educational institutions utilizing XWiki for course management.
• Developers building applications on top of the XWiki framework.

What to do

To protect against this vulnerability, users should take immediate action by upgrading to the latest patched versions of the XWiki Platform. For those unable to upgrade right away, a temporary workaround is available by modifying specific lines in the configuration.

Regular security audits and updates are essential to ensure the integrity of your XWiki installations.

• Upgrade to XWiki versions 15.10.11, 16.4.1, or 16.5.0RC1.
• Implement the suggested configuration changes if an immediate upgrade is not feasible.
• Conduct regular security assessments to identify potential vulnerabilities.
• Stay informed about future updates and patches from XWiki.