xwiki-platform up to 13.10.4/14.2 request.sort Request escape output

Summaryinfo

A vulnerability described as problematic has been identified in xwiki-platform up to 13.10.4/14.2. This affects the function request.sort. Executing a manipulation of the argument Request can lead to escape output. This vulnerability is tracked as CVE-2024-55663. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in xwiki-platform up to 13.10.4/14.2 and classified as problematic. This vulnerability affects the function request.sort. The manipulation of the argument request with an unknown input leads to a escape output vulnerability. The CWE definition for the vulnerability is CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

XWiki Platform is a generic wiki platform. Starting in version 11.10.6 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering of the returned documents is defined from an unsanitized request parameter (request.sort) and can allow any user to inject HQL. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This has been patched in 13.10.5 and 14.3-rc-1. There is no known workaround, other than upgrading XWiki.

The advisory is available at github.com. This vulnerability was named CVE-2024-55663 since 12/10/2024. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 13.10.5 or 14.3-rc1 eliminates this vulnerability. Applying the patch 673076e2e8b88a36cdeaf7007843aa9ca1a068a0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Name

• xwiki-platform

Version

• 13.10.0
• 13.10.1
• 13.10.2
• 13.10.3
• 13.10.4
• 14.0
• 14.1
• 14.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion