CVE-2024-56158

XWiki allows SQL injection in query endpoint of REST API with Oracle

State: Published
Severity: 9.3 Critical
Published: Jun 12, 2025
Updated: Jan 12, 2026
Reserved: Dec 17, 2024

Description

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
xwiki-platformxwiki	>= 1.0, < 15.10.16Affected >= 16.0.0-rc-1, < 16.4.7Affected >= 16.5.0-rc-1, < 16.10.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.