PT-2025-25327 · Hibernate+2 · Hibernate+2

Published 2024-12-17 · Updated 2025-09-03 · CVE-2024-56158

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 15.10.16 XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.2

Description The issue allows execution of any SQL query in Oracle using functions like DBMS XMLGEN or DBMS XMLQUERY. This is due to the XWiki query validator not sanitizing certain functions and Hibernate allowing the use of any native function in an HQL query.

Recommendations For versions prior to 15.10.16, update to version 15.10.16 or later. For versions prior to 16.4.7, update to version 16.4.7 or later. For versions prior to 16.10.2, update to version 16.10.2 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-06726

CVE-2024-56158

GHSA-PRWH-7838-XF82

Affected Products

Hibernate

Oracle

Xwiki

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56158.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22734 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-56158 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-prwh-7838-xf82 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56158 · Security Note
• https://bdu.fstec.ru/vul/2025-06726 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d · Note
• https://t.me/cveNotify/134226 · Telegram Post
• https://twitter.com/CveFindCom/status/1933179981145727301 · Twitter Post
• https://twitter.com/vulert_official/status/1933429992710430916 · Twitter Post
• https://twitter.com/CVEnew/status/1933182822107562042 · Twitter Post
• https://t.me/cvetracker/26092 · Telegram Post