What’s Vulnerable › Vulnerabilities

CVE-2024-21651: XWiki Denial of Service attack through attachments

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-09 · updated 2026-06-17
• Weakness: CWE-400

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.

Affected products

• xwiki-platform: from 14.10 before 14.10.18; from 15.5 before 15.5.3; from 15.6 before 15.8 — fixed in 14.10.18, 15.5.3, 15.8

How to fix

Upgrade to a fixed version: xwiki-platform 14.10.18, 15.5.3, 15.8. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8959-rfxh-r4j4
• https://jira.xwiki.org/browse/XCOMMONS-2796
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8959-rfxh-r4j4
• https://jira.xwiki.org/browse/XCOMMONS-2796

Get alerted when CVE-2024-21651 or the next vulnerability affects your stack