CVE-2024-21650

high-risk
Published 2024-01-08

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.

Do I need to act?

!
92.5% chance of exploitation in next 30 days
EPSS score — higher than 7% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: 8fc6dd5d6fd20323bdad4a5c0947abd17910850f, c08f3b6b8cdebed64f4f513efc968a01892a48d9, b0b2c71ded2c886acbe98a71e0bda1728cf86536
10
CVSS 10.0/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Xwiki

References (6)

Patch https://github.com/xwiki/xwiki-platform/commit/b290bfd573c6f7db6cc15a88dd4111d9f...
Vendor Advisory https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rj7p-xjv7-7229
Exploit https://jira.xwiki.org/browse/XWIKI-21173
Patch https://github.com/xwiki/xwiki-platform/commit/b290bfd573c6f7db6cc15a88dd4111d9f...
Vendor Advisory https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rj7p-xjv7-7229
Exploit https://jira.xwiki.org/browse/XWIKI-21173
58
/ 100
high-risk
Severity 33/34 · Critical
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal