CVE-2024-56158
XWiki allows SQL injection in query endpoint of REST API with Oracle
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
XWiki allows SQL injection in query endpoint of REST API with Oracle
XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.
Reserved 2024-12-17 | Published 2025-06-12 | Updated 2025-06-12 | Assigner GitHub_MCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
github.com/...atform/security/advisories/GHSA-prwh-7838-xf82
jira.xwiki.org/browse/XWIKI-22734
Support options
