Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2024-56158

XWiki allows SQL injection in query endpoint of REST API with Oracle

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

xwiki xwiki-platform

  • >= 1.0, < 15.10.16affected
  • >= 16.0.0-rc-1, < 16.4.7affected
  • >= 16.5.0-rc-1, < 16.10.2affected

References