Threats tagged 'ghsa-rr6p-3pfg-562j'

A critical remote code execution vulnerability exists in the XWiki Platform's Solr search UI component. An unauthenticated guest user can execute arbitrary code by sending a specially crafted request to the SolrSearch endpoint. This compromises the confidentiality, integrity, and availability of the entire XWiki installation. The issue is patched in versions 15.10.11, 16.4.1, and later. Workarounds involve modifying the SolrSearchMacros XML to safely handle the feed content. Public exploit code is available, but no active exploitation in the wild is confirmed.