Improper Access Control
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document does not modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code …