{"id":"CVE-2024-55879","summary":"XWiki allows RCE from script right in configurable sections","details":"XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading.","aliases":["GHSA-r279-47wg-chpr"],"modified":"2026-08-12T15:13:11.063766Z","published":"2024-12-12T19:17:38.138Z","related":["GHSA-r279-47wg-chpr","GHSA-wh34-m772-5398"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55879.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-21207"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55879.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r279-47wg-chpr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55879"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d"},{"type":"EVIDENCE","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"3f100aee4c197e68d2986717a878d0bbd4fb0c22"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"ed06afe4614a2782ddac6e42ed21f180056a206e"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:*:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.3"},{"fixed":"15.10.9"},{"introduced":"16.0.0"},{"fixed":"16.3.0"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"1bf0361e80e94dd763901e3a863b4caaa24b6e17"},{"fixed":"1c4b9ba5f04cd8d636a6718465a0b8e251f51420"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"50fb1f191827504c6173697d6c39aa093301a851"},{"fixed":"8493435ff9606905a2d913607d6c79862d0c168d"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:*:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.3"},{"fixed":"15.10.9"},{"introduced":"16.0.0"},{"fixed":"16.3.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-16.3.0-rc-1","xwiki-commons-15.10.8","xwiki-commons-15.10.7","xwiki-commons-15.10.6","xwiki-commons-15.10.5","xwiki-commons-15.10.4","xwiki-commons-15.10.3","xwiki-commons-15.10.2","xwiki-commons-15.10.1","xwiki-commons-15.10","xwiki-commons-15.10-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55879.json","vanir_signatures_modified":"2026-08-12T15:13:11Z","vanir_signatures":[{"id":"CVE-2024-55879-01eaac4a","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d","target":{"file":"xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/test/java/org/xwiki/administration/ConfigurableClassPageTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"236992300391277556217378332457867545182","length":712}},{"target":{"file":"xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/test/java/org/xwiki/administration/ConfigurableClassPageTest.java","function":"checkScriptRight"},"deprecated":false,"digest":{"function_hash":"80797114820277573592219065610970345622","length":1263},"id":"CVE-2024-55879-8fedb097","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d"},{"deprecated":false,"digest":{"line_hashes":["209161574377728761043116483541213496716","176869214448177095988789824904650296895","183463755079819425991089555567333209492","311974343199307524466490082628170242319","177443356313965610309158258852035936960","151534286446640185703922743335022821142","263486596542065634817245577714402253766","182697580140364187126886547571909086457","326541991244629128376665833268163046923","66726863852917978464988524575564641378","282418863558437391064037525662000018647","302537729189063189521383400244718585078","332726563288626311229564541772554881618","204401985300051435345067799007887467714","199626531698945121904162988375912544219","255759114264745598448339811904960213115","13437552843303005776081609052057576295","239792704208419815421453019887600605653","298211165952676017968033695890469247413","320520918919314400144707579895830399890","205768257667498665619494444254274381339","182666193011307363221176648219403342751","292021706169061952570328008134243395913","12634528113923032300510451024038863106","36070476884631980724382535522939910147","217862868595680684075159044107096748594","71457223400197470553246857296083857090","238287114221003640551472382295105642965","147305954995447523075690537467446255820","104705912299772775840076961237413087949","77173728112052242371127160628168139794","275000435236607197427066859692080925488","90034652113259410694034232645959973907","55757152012966220629586602017647554919","47258802170825083931144140667972695740","326564075106381809743080382797717057314","303930380382386922558950638188134930479","132861621073128040554049398155629857841","200562433780640854012238760838999357419","222428809391772391158613680457773399526","23220054141384218956116222389727245432","50250418155882563489311515001338334020","307936252344812426390763154640583503023","95195544305406473247621671551412862076","120259910186977638077225211319014100328","184247451948149273616590541844913790919","94848988495237535935492047089978640039","146687846040791670463816991940821023730","32918891334412752573011887060138380110","169212284298489123497956384093940991819","182245102451658064082630141067076651109","250119862470441255852297027014783796428","290284058722694231439217758135846287445","144690559262065437008819409434548308795","106924612733837558842875734190867065085","125797368803989791040927918822545433247"],"threshold":0.9},"id":"CVE-2024-55879-d8d3a95b","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d","target":{"file":"xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/test/java/org/xwiki/administration/ConfigurableClassPageTest.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}