Skip to content
OpenAdvisories
High WID-SEC-2024-3695 5 CVEs

xwiki: Mehrere Schwachstellen

Published Dec 12, 2024 · Updated Dec 12, 2024 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um beliebigen Programmcode auszuführen oder Daten zu manipulieren.

Product

XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen

Vulnerabilities 5

  • Critical 10.0
    CVE-2024-55662

    XWiki allows remote code execution through the extension sheet

    XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the se…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-repository-server-ui Maven
  • Critical 10.0
    CVE-2024-55877

    XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList

    XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This co…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-help-ui Maven
  • Critical 9.1
    CVE-2024-55879

    XWiki allows RCE from script right in configurable sections

    XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises th…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-administration-ui Maven
  • High 8.6
    CVE-2024-55663

    XWiki Platform has an SQL injection in getdocuments.vm with sort parameter

    XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering of the returned documents is defined from an unsanitized request parameter (request.sort) and can all…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-distribution-war Maven
  • Medium 5.4
    CVE-2024-55876

    XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

    XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without an…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-scheduler-ui Maven

Revision history

  1. #1

    Initiale Fassung

References