CVE-2024-55877

XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList

State: Published
Severity: 10.0 Critical
Published: Dec 12, 2024
Updated: Dec 13, 2024
Reserved: Dec 11, 2024

Description

XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible to manually apply the patch to the page `XWiki.XWikiSyntaxMacrosList` as a workaround.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Affected Products

Product	Versions
xwiki-platformxwiki	>= 9.7-rc-1, < 15.10.11Affected >= 16.0.0-rc-1, < 16.4.1Affected >= 16.5.0-rc-1, < 16.5.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.