XWiki Platform may allow privilege escalation to programming rights via user's first name
### Impact
Any user can edit his own profile and inject code which is going to be executed with programming right.
Steps to reproduce:
* Set your first name to
```
{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}
```
The first name appears as interpreted "`Hello from groovy`" instead of the expected fully escaped "`{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}`".
The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes
https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application that use a short text field.
### Patches
The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
### Workarounds
There are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file.
### References
*
https://jira.xwiki.org/browse/XWIKI-19793
*
https://jira.xwiki.org/browse/XWIKI-19794
*
https://jira.xwiki.org/browse/XCOMMONS-2498
### For more information
If you have any questions or comments about this advisory:
* Open an issue in Jira
XWiki.org https://jira.xwiki.org/
* Email us at [Security Mailing List](mailto:security@xwiki.org)