GHSA-8cw6-4r32-6r3h

### Impact
Any user can edit his own profile and inject code which is going to be executed with programming right.

Steps to reproduce:

* Set your first name to

```
{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}
```

The first name appears as interpreted "`Hello from groovy`" instead of the expected fully escaped "`{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}`".

The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using [Apps Within Minutes](https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application) that use a short text field.

### Patches
The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

### Workarounds
There are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file.

### References
* https://jira.xwiki.org/browse/XWIKI-19793
* https://jira.xwiki.org/browse/XWIKI-19794
* https://jira.xwiki.org/browse/XCOMMONS-2498

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:[email protected])