What’s Vulnerable › Vulnerabilities

CVE-2024-55663: XWiki Platform has an SQL injection in getdocuments.vm with sort parameter

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-12 · updated 2026-06-17
• Weakness: CWE-116

Description

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering of the returned documents is defined from an unsanitized request parameter (request.sort) and can allow any user to inject HQL. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This has been patched in 13.10.5 and 14.3-rc-1. There is no known workaround, other than upgrading XWiki.

Affected products

• xwiki-platform: from 6.4 before 13.10.5; from 14.0 before 14.3; 6.3, 6.3-milestone2, 6.3-rc1 — fixed in 13.10.5, 14.3

How to fix

Upgrade to a fixed version: xwiki-platform 13.10.5, 14.3. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/673076e2e8b88a36cdeaf7007843aa9ca1a068a0
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398
• https://jira.xwiki.org/browse/XWIKI-17568

Get alerted when CVE-2024-55663 or the next vulnerability affects your stack