GitHub Advisoryadvisory · Maven

GHSA-prwh-7838-xf82 XWiki allows SQL injection in query endpoint of REST API with Oracle

CRITICAL Published 2025-06-12 Modified 2026-01-12 Official page ↗
Aliases
CVE-2024-56158
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-oldcore
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-89
Reviewed
2025-06-12

Affected packages

• Maven org.xwiki.platform:xwiki-platform-oldcore: >= 1.0, < 15.10.16 → fixed in 15.10.16 • Maven org.xwiki.platform:xwiki-platform-oldcore: >= 16.0.0-rc-1, < 16.4.7 → fixed in 16.4.7 • Maven org.xwiki.platform:xwiki-platform-oldcore: >= 16.5.0-rc-1, < 16.10.2 → fixed in 16.10.2

Description

Impact It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple `select` and Hibernate allows using any native function in an HQL query. Patches This has been patched in 16.10.2, 16.4.7 and 15.10.16. Workarounds There is no known workaround, other than upgrading XWiki. References https://jira.xwiki.org/browse/XWIKI-22734 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki.org • Email us at Security Mailing List

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References