Description
XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| xwiki | xwiki-platform | >= 1.0, < 15.10.16, >= 16.0.0-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-oldcore | >= 1.0, < 15.10.16 | 15.10.16 | GHSA-prwh-7838-xf82 |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | >= 16.0.0-rc-1, < 16.4.7 | 16.4.7 | GHSA-prwh-7838-xf82 |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | >= 16.5.0-rc-1, < 16.10.2 | 16.10.2 | GHSA-prwh-7838-xf82 |
Advisories 1
- WID-SEC-2025-1317 xwiki: Schwachstelle ermöglicht SQL Injection BSI CERT-Bund (WID) · Jun 12, 2025