Loading...
Skip to main content
GeekWala

CVE-2024-37899

CRITICAL

XWiki Platform allows remote code execution from user account

Published June 20, 2024Updated February 5, 2025Source: osv

Summary

### Impact When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable the user account. To reproduce, as a user without script nor programming rights, edit the about section of your user profile and add `{{groovy}}services.logging.getLogger("attacker").error("Hello from Groovy!"){{/groovy}}`. As an admin, go to the user profile and click the "Disable this account" button. Then, reload the page. If the logs show `attacker - Hello from Groovy!` then the instance is vulnerable. ### Patches This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. ### Workarounds We're not aware of any workaround except upgrading. ### References * https://jira.xwiki.org/browse/XWIKI-21611 * https://github.com/xwiki/xwiki-platform/commit/f89c8f47fad6e5cc7e68c69a7e0acde07f5eed5a

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.xwiki.platform:xwiki-platform-oldcore to 14.10.21 or later
<!-- Update pom.xml dependency version to 14.10.21 for org.xwiki.platform:xwiki-platform-oldcore -->
Maven
Update org.xwiki.platform:xwiki-platform-oldcore to 15.5.5 or later
<!-- Update pom.xml dependency version to 15.5.5 for org.xwiki.platform:xwiki-platform-oldcore -->
Maven
Update org.xwiki.platform:xwiki-platform-oldcore to 14.10.21 or later
<!-- Update pom.xml dependency version to 14.10.21 for org.xwiki.platform:xwiki-platform-oldcore -->
Maven
Update org.xwiki.platform:xwiki-platform-oldcore to 15.10.6 or later
<!-- Update pom.xml dependency version to 15.10.6 for org.xwiki.platform:xwiki-platform-oldcore -->
Maven
Update org.xwiki.platform:xwiki-platform-oldcore to 16.0.0 or later
<!-- Update pom.xml dependency version to 16.0.0 for org.xwiki.platform:xwiki-platform-oldcore -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (5)

PackageEcosystemAffectedFixed In
org.xwiki.platform:xwiki-platform-oldcore
maven
All versions14.10.21
org.xwiki.platform:xwiki-platform-oldcore
maven
All versions15.5.5
org.xwiki.platform:xwiki-platform-oldcore
maven
All versions14.10.21
org.xwiki.platform:xwiki-platform-oldcore
maven
All versions15.10.6
org.xwiki.platform:xwiki-platform-oldcore
maven
All versions16.0.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-37899?
XWiki Platform allows remote code execution from user account This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.0/10).
How do I check if my project is affected by CVE-2024-37899?
CVE-2024-37899 affects org.xwiki.platform:xwiki-platform-oldcore. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-37899 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-j584-j2vj-3f93

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies