CVEvulnerability

CVE-2024-37901

8.8 HIGH Published 2024-07-31 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-07-31
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-862, CWE-94, CWE-95

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of `XWiki.SearchSuggestConfig` and `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.21, 15.5.5 and 15.10.2.

Affected configurations

• xwiki xwiki (>= 9.2 < 14.10.21) • xwiki xwiki (>= 15.0 < 15.5.5) • xwiki xwiki (>= 15.6 < 15.10.2)

Related

Weakness · CWE (3)

  • CWE-862 Missing Authorization weakness
  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References