CVE-2024-56158

CRITICAL

XWiki allows SQL injection in query endpoint of REST API with Oracle

Published June 12, 2025Updated February 3, 2026Source: osv

Summary

### Impact It's possible to execute any SQL query in Oracle by using the function like [DBMS_XMLGEN or DBMS_XMLQUERY](https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_XMLGEN.html). The XWiki query validator does not sanitize functions that would be used in a simple `select` and Hibernate allows using any native function in an HQL query. ### Patches This has been patched in 16.10.2, 16.4.7 and 15.10.16. ### Workarounds There is no known workaround, other than upgrading XWiki. ### References https://jira.xwiki.org/browse/XWIKI-22734 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.xwiki.platform:xwiki-platform-oldcore to 16.10.2 or later

<!-- Update pom.xml dependency version to 16.10.2 for org.xwiki.platform:xwiki-platform-oldcore -->

Maven

Update org.xwiki.platform:xwiki-platform-oldcore to 16.4.7 or later

<!-- Update pom.xml dependency version to 16.4.7 for org.xwiki.platform:xwiki-platform-oldcore -->

Maven

Update org.xwiki.platform:xwiki-platform-oldcore to 15.10.16 or later

<!-- Update pom.xml dependency version to 15.10.16 for org.xwiki.platform:xwiki-platform-oldcore -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Package	Ecosystem	Affected	Fixed In
org.xwiki.platform:xwiki-platform-oldcore	maven	All versions	16.10.2
org.xwiki.platform:xwiki-platform-oldcore	maven	All versions	16.4.7
org.xwiki.platform:xwiki-platform-oldcore	maven	All versions	15.10.16

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-89
SQL InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2024-56158?: XWiki allows SQL injection in query endpoint of REST API with Oracle This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-56158?: CVE-2024-56158 affects org.xwiki.platform:xwiki-platform-oldcore. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-56158 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-prwh-7838-xf82

Related CVEs

CVE-2023-26474
CRITICAL
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
CVE-2023-36468
CRITICAL
Upgrading doesn't prevent exploiting vulnerable XWiki documents
CVE-2024-31987
CRITICAL
XWiki Platform remote code execution from account via custom skins support
CVE-2023-29526
CRITICAL
XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
CVE-2023-46242
CRITICAL
XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
CVE-2024-37899
CRITICAL
XWiki Platform allows remote code execution from user account
CVE-2025-49586
HIGH
XWiki allows remote code execution through preview of XClass changes in AWM editor
CVE-2026-40104
MEDIUM
XWiki's REST APIs can list all pages/spaces, leading to unavailability

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies