CVE-2024-37901

Katalog CVE

CVSS 8.8 · High EPSS 1,1%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada xwiki. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of `XWiki.SearchSuggestConfig` and `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.21, 15.5.5 and 15.10.2.

Rincian

Terbit di NVD

31 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-862: Missing Authorization
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h63h-5c77-77p5 advisory vendor
• https://jira.xwiki.org/browse/XWIKI-21473 issue tracking · advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/0b135760514fef73db748986a3311f3edd4a553b patch
• https://github.com/xwiki/xwiki-platform/commit/742cd4591642be4cdcaf68325f17540e0934e64e patch
• https://github.com/xwiki/xwiki-platform/commit/9ce3e0319869b6d8131fc4e0909736f7041566a4 patch
• https://github.com/xwiki/xwiki-platform/commit/bbde8a4f564e3c28839440076334a9093e2b4834 patch