CVE-2024-55879 json
XWiki allows RCE from script right in configurable sections
published 2024-12-12 22 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-3502 , GHSA-r279-47wg-chpr
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-administration-ui 15.10.9, 16.3.0
- org.xwiki.platform xwiki-platform-administration-ui 15.10.9, 16.3.0
- xwiki xwiki 15.10.9, 16.3.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 22 mo ago
Exploit prediction
1.07% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398 referenced PoC, tagged "exploit" by a source, unverified
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-21207 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-administration-ui | >=2.3, <15.10.9 >=16.0.0-rc-1, <16.3.0 |
15.10.9 16.3.0 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d
web, patch
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398
exploit, not-applicable
-
jira.xwiki.org
/browse/XWIKI-21207
web, exploit, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-r279-47wg-chpr
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-55879
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2024-55879
- GitHub Advisory GHSA-r279-47wg-chpr
- NVD CVE-2024-55879
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.