{"id":"CVE-2024-21650","published":"2024-01-08T15:18:12Z","modified":"2025-06-17T20:39:15Z","title":"XWiki Remote Code Execution vulnerability via user registration","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 2.2, < 14.10.17",">= 15.0-rc-1, < 15.5.3",">= 15.6-rc-1, < 15.8-rc-1"]}],"description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the \"first name\" or \"last name\" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.","provenance":"source","from":"CVE.org"},"summary":{"text":"The XWiki Platform (xwiki-platform) contains a remote code execution flaw, classified as improper neutralization of directives in dynamically evaluated code, in its user registration feature. An attacker who can reach the registration form, which affects installations with guest user registration enabled, can run arbitrary code on the server by submitting a crafted payload in the first name or last name fields, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:39Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.9348,"percentile":0.99839,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-09-25","exploitedFirstSeen":"2025-09-25","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2024-21650","date":"2025-09-25"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-95","name":"Improper Neutralization of Directives in Dynamically Evaluated Code"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rj7p-xjv7-7229","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/b290bfd573c6f7db6cc15a88dd4111d9fcad0d31","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21173","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-administration-ui","vulnerableRanges":[">=2.2, <14.10.17",">=15.0-rc-1, <15.5.3",">=15.6-rc-1, <15.8-rc-1"],"patched":["14.10.17","15.5.3","15.8-rc-1"],"from":["GHSA-rj7p-xjv7-7229"],"provenance":"source"}],"advisories":[{"id":"GHSA-rj7p-xjv7-7229","url":"https://github.com/advisories/GHSA-rj7p-xjv7-7229","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-administration-ui","vulnerableRanges":[">=2.2, <14.10.17"],"patched":["14.10.17"],"provenance":"source","from":"GHSA"},{"id":"GHSA-rj7p-xjv7-7229","url":"https://github.com/advisories/GHSA-rj7p-xjv7-7229","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-administration-ui","vulnerableRanges":[">=15.0-rc-1, <15.5.3"],"patched":["15.5.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-rj7p-xjv7-7229","url":"https://github.com/advisories/GHSA-rj7p-xjv7-7229","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-administration-ui","vulnerableRanges":[">=15.6-rc-1, <15.8-rc-1"],"patched":["15.8-rc-1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-0417","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0417","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2024-21650","name":"XWiki < 4.10.20 - Remote code execution","severity":"critical","path":"http/cves/2024/CVE-2024-21650.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21650.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-01-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-21650","provenance":"source"},{"date":"2025-09-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2024-21650","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":67.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 401 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9984"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2023-46731","published":"2023-11-06","fixed":"15.5.1","kev":false},{"cve":"CVE-2023-50722","published":"2023-12-15","fixed":"15.7-rc-1","kev":false},{"cve":"CVE-2023-50723","published":"2023-12-15","fixed":"15.7-rc-1","kev":false,"link":{"from":"CVE-2023-50723","to":"CVE-2024-21650","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-administration-ui","fromFixed":"14.10.15","toFixed":"14.10.17","daysApart":24},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-administration-ui","fromFixed":"15.5.2","toFixed":"15.5.3","daysApart":24}]}},{"cve":"CVE-2024-21650","published":"2024-01-08","fixed":"15.8-rc-1","kev":false},{"cve":"CVE-2024-55879","published":"2024-12-12","fixed":"16.3.0","kev":false,"link":{"from":"CVE-2024-21650","to":"CVE-2024-55879","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-administration-ui","fromFixed":"15.8-rc-1","toFixed":"15.10.9","daysApart":339}]}}],"package":"Maven:org.xwiki.platform:xwiki-platform-administration-ui"}}