Vulnerability · Published Dec 12, 2024 · Assigned by GitHub_M

CVE-2024-55879XWiki allows RCE from script right in configurable sections

Critical 9.1

In plain English

A critical-severity missing authorization in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)1.1%top 35.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.xwiki.platform:xwiki-platform-administration-ui	15.10.9	GHSA-r279-47wg-chpr
Maven	org.xwiki.platform:xwiki-platform-administration-ui	16.3.0	GHSA-r279-47wg-chpr

Affected products (as reported)

Vendor	Product	Versions
xwiki	xwiki-platform	>= 2.3, < 15.10.9>= 16.0.0-rc-1, < 16.3.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r279-47wg-chpr x_refsource_CONFIRM
https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-21207 x_refsource_MISC
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398 exploit