{"id":"CVE-2024-56158","published":"2025-06-12T14:56:56Z","modified":"2026-01-12T14:43:46Z","title":"XWiki allows SQL injection in query endpoint of REST API with Oracle","vendor":"xwiki","product":"xwiki-platform","tier":"tail","description":{"text":"XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00512,"percentile":0.43516,"provenance":"source"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-22734","tags":["x_refsource_MISC"]}],"priority":{"score":15.2,"factors":[{"name":"EPSS percentile","points":8.7},{"name":"CVSS severity","points":6.51}]},"vendorSlug":"xwiki","affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 1.0, < 15.10.16",">= 16.0.0-rc-1, < 16.4.7",">= 16.5.0-rc-1, < 16.10.2"]}],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","vulnerableRanges":[">=1.0, <15.10.16",">=16.0.0-rc-1, <16.4.7",">=16.5.0-rc-1, <16.10.2"],"patched":["15.10.16","16.4.7","16.10.2"],"from":["GHSA-prwh-7838-xf82"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-54677","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-37899","published":"2024-06-20","fixed":"16.0.0","kev":false},{"cve":"CVE-2024-43400","published":"2024-08-19","fixed":"16.0.0","kev":false,"link":{"from":"CVE-2024-43400","to":"CVE-2024-56158","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"15.10.6","toFixed":"15.10.16","daysApart":297}]}},{"cve":"CVE-2025-32968","published":"2025-04-23","fixed":"16.10.1","kev":false,"link":{"from":"CVE-2025-32968","to":"CVE-2024-56158","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"16.10.1","toFixed":"16.10.2","daysApart":50}]}},{"cve":"CVE-2024-56158","published":"2025-06-12","fixed":"16.10.2","kev":false},{"cve":"CVE-2025-49586","published":"2025-06-13","fixed":"17.0.0","kev":false,"link":{"from":"CVE-2024-56158","to":"CVE-2025-49586","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"16.10.2","toFixed":"16.10.3","daysApart":1}]}},{"cve":"CVE-2025-54124","published":"2025-08-05","fixed":"17.2.0-rc-1","kev":false},{"cve":"CVE-2025-54125","published":"2025-08-05","fixed":"17.2.0-rc-1","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-oldcore"}}