XWiki allows remote code execution through the extension sheet
Description
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since Extension Repository Application is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page ExtensionCode.ExtensionSheet and to the page ExtensionCode.ExtensionAuthorsDisplayer.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.xwiki.platform:xwiki-platform-repository-server-uiMaven | >= 3.3-milestone-1, < 15.10.9 | 15.10.9 |
org.xwiki.platform:xwiki-platform-repository-server-uiMaven | >= 16.0.0-rc-1, < 16.3.0 | 16.3.0 |
Affected products
2- ghsa-coordsRange: >= 3.3-milestone-1, < 15.10.9
- Range: >= 3.3-milestone-1, < 15.10.9
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-j2pq-22jj-4pm5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-55662ghsaADVISORY
- github.com/xwiki/xwiki-platform/commit/8659f17d500522bf33595e402391592a35a162e8ghsax_refsource_MISCWEB
- github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2pq-22jj-4pm5ghsax_refsource_CONFIRMWEB
- jira.xwiki.org/browse/XWIKI-21890ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.