GHSA-prwh-7838-xf82

Source

https://github.com/advisories/GHSA-prwh-7838-xf82

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-prwh-7838-xf82/GHSA-prwh-7838-xf82.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-prwh-7838-xf82

Aliases

CVE-2024-56158

Published

2025-06-12T21:52:50Z

Modified

2026-02-03T03:02:46Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

XWiki allows SQL injection in query endpoint of REST API with Oracle

Details

Impact

It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY.

The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query.

Patches

This has been patched in 16.10.2, 16.4.7 and 15.10.16.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

https://jira.xwiki.org/browse/XWIKI-22734

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-12T21:52:50Z",
    "nvd_published_at": "2025-06-12T15:15:38Z",
    "severity": "CRITICAL"
}

References

Affected packages

Maven

org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0

Fixed

15.10.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-prwh-7838-xf82/GHSA-prwh-7838-xf82.json"

org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16.0.0-rc-1

Fixed

16.4.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-prwh-7838-xf82/GHSA-prwh-7838-xf82.json"

org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16.5.0-rc-1

Fixed

16.10.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-prwh-7838-xf82/GHSA-prwh-7838-xf82.json"