{"id":"CVE-2024-55879","published":"2024-12-12T19:17:38Z","modified":"2024-12-13T14:54:21Z","title":"XWiki allows RCE from script right in configurable sections","vendor":"xwiki","product":"xwiki-platform","tier":"tail","description":{"text":"XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01066,"percentile":0.64768,"provenance":"source"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r279-47wg-chpr","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21207","tags":["x_refsource_MISC"]},{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398","tags":["exploit"]}],"priority":{"score":24.3,"factors":[{"name":"EPSS percentile","points":12.95},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"xwiki","affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 2.3, < 15.10.9",">= 16.0.0-rc-1, < 16.3.0"]}],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-administration-ui","vulnerableRanges":[">=2.3, <15.10.9",">=16.0.0-rc-1, <16.3.0"],"patched":["15.10.9","16.3.0"],"from":["GHSA-r279-47wg-chpr"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3502","exploited":false,"provenance":"source"},"exploitRefs":["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398"],"lineage":{"familyId":"fam-xwiki-platform-cve-2024-55663","parents":[{"from":"CVE-2024-55663","to":"CVE-2024-55879","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-wh34-m772-5398","via":"related"}]}],"packageHistory":[{"cve":"CVE-2023-50722","published":"2023-12-15","fixed":"15.7-rc-1","kev":false},{"cve":"CVE-2023-50723","published":"2023-12-15","fixed":"15.7-rc-1","kev":false},{"cve":"CVE-2024-21650","published":"2024-01-08","fixed":"15.8-rc-1","kev":false,"link":{"from":"CVE-2024-21650","to":"CVE-2024-55879","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-administration-ui","fromFixed":"15.8-rc-1","toFixed":"15.10.9","daysApart":339}]}},{"cve":"CVE-2024-55879","published":"2024-12-12","fixed":"16.3.0","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-administration-ui"}}