{"id":"CVE-2024-56158","summary":"XWiki allows SQL injection in query endpoint of REST API with Oracle","details":"XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.","aliases":["GHSA-prwh-7838-xf82"],"modified":"2026-08-12T15:15:45.264179Z","published":"2025-06-12T14:56:56.939Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56158.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22734"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56158.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56158"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"d8a509c53e75e2773666a2824b6f8e24c650419f"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"c3bb3381253c71df533fe0c31a02d3ce1e04bae7"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"1da347736459c78e29bcc736468e6c007ea828e6"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0"},{"fixed":"15.10.16"},{"introduced":"16.0.0"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"93d8322eda7b68fd66f33334b982b047d7cf4f36"},{"fixed":"110b60483db6e4ba9b1edfc0747a94a81d5296cf"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"f5a9a0762750936523187286919ec4c1892d6fea"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"105d934fe5a2f9a74958fef57cede8436c5cb63c"},{"fixed":"ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0"},{"fixed":"15.10.16"},{"introduced":"16.0.0"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-16.4.6","xwiki-commons-16.10.1","xwiki-commons-15.10.15","xwiki-commons-16.10.0","xwiki-commons-16.10.0-rc-1","xwiki-commons-15.10.14","xwiki-commons-16.4.5","xwiki-commons-15.10.13","xwiki-commons-16.4.4","xwiki-commons-16.4.3","xwiki-commons-15.10.12","xwiki-commons-16.4.2","xwiki-commons-16.4.1","xwiki-commons-15.10.11","xwiki-commons-16.4.0","xwiki-commons-15.10.10","xwiki-commons-16.4.0-rc-1","xwiki-commons-15.10.9","xwiki-commons-15.10.8","xwiki-commons-15.10.7","xwiki-commons-15.10.6","xwiki-commons-15.10.5","xwiki-commons-15.10.4","xwiki-commons-15.10.3","xwiki-commons-15.10.2","xwiki-commons-15.10.1","xwiki-commons-15.10","xwiki-commons-15.10-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56158.json","vanir_signatures_modified":"2026-08-12T15:15:45Z","vanir_signatures":[{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/query/hql/internal/StandardHQLCompleteStatementValidator.java","function":"isAllowedAllTableColumns"},"deprecated":false,"digest":{"function_hash":"189245505877726022919220266294312434629","length":196},"id":"CVE-2024-56158-98d6d722","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d"},{"deprecated":false,"digest":{"line_hashes":["80858588069353650013320143885439827446","244162466944943738623198209739764373584","128299822323110704974936036485904507935","278794280172128963660463204001215916365","69931236865940592543432157197084614733","122481631644564978545989872820455096026","335186725883391693566888296506466643357","203518741667416764134949147521951714877","162192788590106360266772599423851516335","244191456151540658191586707207237093449","65253137047822419686460905649236005151","75930305575668025764964915306596655453","326111562040156768036525418841759250425","194233240734623404346961099412703402298","108157936597573392118458961010947783735","30583041099340244783965149916078370953","45664684365818546046021908645569060173","88082379301626145973782249255681196561","80188471245989518003253162538324821427"],"threshold":0.9},"id":"CVE-2024-56158-9f80c258","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/query/hql/internal/StandardHQLCompleteStatementValidator.java"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/query/hql/internal/StandardHQLCompleteStatementValidator.java","function":"addFromItem"},"deprecated":false,"digest":{"function_hash":"128918765184430953151267115114836323634","length":225},"id":"CVE-2024-56158-c4a3cef4","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d"},{"deprecated":false,"digest":{"function_hash":"302343325834938897113750455795137054004","length":260},"id":"CVE-2024-56158-ed8b8084","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/query/hql/internal/StandardHQLCompleteStatementValidator.java","function":"isSelectExpressionAllowed"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}