XWiki Remote Macros Excerpt-Include Macro Remote Code Execution Vulnerability

The XWiki Remote Macros extension contains a syntax injection vulnerability in its excerpt-include macro, affecting versions from 1.13 to 1.14.4.

The macro does not properly escape the included page's title and renders excerpt content into XWiki syntax without sanitization.

• Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or excerpt.
• This can lead to remote code execution when the page is included.
• The flaw affects confidentiality, integrity, and availability of the whole XWiki installation.
• The issue is fixed in version 1.14.5.