CVE-2024-55663
criticalpriority · track · 39EPSS 0.007 · 55 %ileDEEURUUSEPSS · scored 2026-10-27
XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering of the returned documents is defined from an unsanitized request parameter (request.sort) and can allow any user to inject HQL. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This has been patched in 13.10.5 and 14.3-rc-1. There is no known workaround, other than upgrading XWiki.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.1–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (13)
Products and version ranges known to be affected.
- Maven org.xwiki.platform:xwiki-platform-distribution-war14.0-rc-1 → 14.3-rc-1osvUSpkg:maven/org.xwiki.platform/xwiki-platform-distribution-war
- Maven org.xwiki.platform:xwiki-platform-distribution-war6.3-milestone-2 → 13.10.5osvUSpkg:maven/org.xwiki.platform/xwiki-platform-distribution-war
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-3695xwiki: Mehrere SchwachstellenDeutsch2024-12-12csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um beliebigen Programmcode auszuführen oder Daten zu manipulieren.
- GHSA-wh34-m772-5398XWiki Platform has an SQL injection in getdocuments.vm with sort parameter2024-12-12ghsa · osvUS
### Impact In `getdocument.vm` ; the ordering of the returned documents is defined from an unsanitized request parameter (request.sort) and can allow any user to inject HQL. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. It's possible to employ database backend dependent techniques of breaking out of HQL query context, described, for example, here: https://www.sonarsource.com/blog/exploiting-hibernate-injections. ### Patches This has been patched in 13.10.5 and 14.3-rc-1. ### Workarounds There is no known workaround, other than upgrading XWiki. ### References https://jira.xwiki.org/browse/XWIKI-17568 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- https://github.com/xwiki/xwiki-platform/commit/673076e2e8b88a36cdeaf7007843aa9ca1a068a0cnnvd
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398cnnvd
- https://jira.xwiki.org/browse/XWIKI-17568cnnvd
- https://github.com/xwiki/xwiki-platform/commit/673076e2e8b88a36cdeaf7007843aa9ca1a068a0enisa_euvd
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398enisa_euvd
- https://jira.xwiki.org/browse/XWIKI-17568enisa_euvd
- https://github.com/xwiki/xwiki-platform/commit/673076e2e8b88a36cdeaf7007843aa9ca1a068a0Patchnvd
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan