PT-2024-36598 · Xwiki · Xwiki Platform

Manuelleduc · Published 2024-12-12 · Updated 2025-02-26 · CVE-2024-55879

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 2.3 through 15.10.8 XWiki Platform versions 16.3.0 before the patch

Description The issue allows any user with script rights to perform arbitrary remote code execution by adding instances of XWiki.ConfigurableClass to any page, compromising the confidentiality, integrity, and availability of the whole XWiki installation.

Recommendations For XWiki Platform versions 2.3 through 15.10.8, upgrade to version 15.10.9. For XWiki Platform versions 16.3.0 before the patch, upgrade to version 16.3.0 with the patch applied. As a temporary workaround, consider restricting access to the XWiki.ConfigurableClass to minimize the risk of exploitation.

Exploit

Fix

RCE

Missing Authorization

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-862

CWE-116

Related Identifiers

CVE-2024-55879

GHSA-R279-47WG-CHPR

GHSA-WH34-M772-5398

Affected Products

Xwiki Platform

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55879.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r279-47wg-chpr · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-55663 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-55879 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55879 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wh34-m772-5398 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21207 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r279-47wg-chpr · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/673076e2e8b88a36cdeaf7007843aa9ca1a068a0 · Note
• https://t.me/cvenotify/104187 · Telegram Post
• https://twitter.com/CveFindCom/status/1867291376477442202 · Twitter Post
• https://jira.xwiki.org/browse/XWIKI-17568 · Note