{"id":"CVE-2024-55877","summary":"XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList","details":"XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible to manually apply the patch to the page `XWiki.XWikiSyntaxMacrosList` as a workaround.","aliases":["GHSA-2r87-74cx-2p7c"],"modified":"2026-08-12T15:16:08.445932Z","published":"2024-12-12T19:13:43.128Z","database_specific":{"cwe_ids":["CWE-96"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55877.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22030"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55877.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2r87-74cx-2p7c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55877"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"4434650d358ae45e1bbe637b7815864b2792d093"},{"fixed":"19099ac5630b3ac7fe63653880853d04e2cbcfc1"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"7b37609e4597937576d9ab789fa3fb6ab52a24fb"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.7"},{"fixed":"15.10.11"},{"introduced":"16.0.0"},{"fixed":"16.4.1"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"f6a8e1e8c16f4f8d639aed5eec2b6e0cb4bad037"},{"fixed":"197973569f711b6ee116096b4887d30410493f06"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"c5e378200ac0047419ddd8c5071396ac35df9025"},{"fixed":"40e1afe001d61eafdf13f3621b4b597a0e58a3e3"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.7"},{"fixed":"15.10.11"},{"introduced":"16.0.0"},{"fixed":"16.4.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55877.json","vanir_signatures_modified":"2026-08-12T15:16:08Z","vanir_signatures":[{"target":{"file":"xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-ui/src/test/java/org/xwiki/help/XWikiSyntaxMacrosListPageTest.java"},"deprecated":false,"digest":{"line_hashes":["337191155632157433787701760386176120088","51595206962790801950244819469181186262","299004658086059922611325391067324922394","90645369634270521611636115578984681750","43376088918460774220711317085128669976","4579438905887909508038769460040360956","143999835240777474433920345730557642999","271061518531847221832422933936371473730","183305753305026498371063202840476950335","260586848393835204588272271181919790407","11566738046563097967152267526427996709","332593145301089461574645277531167931549","340233786086022554465838678371499862104","97619896567674463128425947229268485883","315372834211655762971685307192825197588","301399188057892103492253664238548564811","261660962630362382323490686357667638269","339033024248385775352666603989143747730","63162028191248408900514501598144161374","97010752657544919550870771770436390948","42014181753918850987503056476642170957","304884510400453484065091328048834773185","183137096269965340537899060573943984520","244349722351065900298951459318604716997","201597694906293789785176503718227492051","260847941314024250045829849593872447326","182223752353860079918429357958710698818","222153894727938019164356640264551718624","137088312748521104335424694740540490443","14229006812138847428123465280393343361","296593380127428306494724999200219757221","31214247265241369892530006268244960277","262711755181060109736789890834227842078","19079151154738647510864134670240058142","66649317536792126110140251390447148111","106132064078943786541864384594876089197","92331908671136654502448544597593826614","222302209887307219712411015872315978219","116442350574082073292549301009233534071","177107479254323875123540510908421140608","81754224701762329760187572754101414048","15560630179594310043832171650141233045","292857533014885523203654319778820838454","141454986719010731952551111368995933198","114224561833697336627760879648881906357","30418496265086103558625767145727935144"],"threshold":0.9},"id":"CVE-2024-55877-8bf5642e","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3"},{"source":"https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3","target":{"file":"xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-ui/src/test/java/org/xwiki/help/XWikiSyntaxMacrosListPageTest.java","function":"renderTable"},"deprecated":false,"digest":{"function_hash":"105691355273371000797911932708032168622","length":2450},"id":"CVE-2024-55877-9e0bf343","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}