CVE-2024-55879

XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading.

• CWE-862

• https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168dPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r279-47wg-chprVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21207Exploit, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398Not Applicable

Published

Dec 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55864Cross-site scripting vulnerability exists in My WP Customize…4.8
• CVE-2024-5587A vulnerability was found in Casdoor up to 1.335.0. It has b…6.9
• CVE-2024-55875http4k is a functional toolkit for Kotlin HTTP applications.…9.8
• CVE-2024-55876XWiki Platform is a generic wiki platform. Starting in versi…5.4
• CVE-2024-55877XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-55878SimpleXLSX is software for parsing and retrieving data from …6.8
• CVE-2024-5588A vulnerability was found in itsourcecode Learning Managemen…8.8
• CVE-2024-55881In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-55884In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), an…9
• CVE-2024-55885beego is an open-source web framework for the Go programming…7.5
• CVE-2024-55886OpenSearch Data Prepper is a component of the OpenSearch pro…6.9
• CVE-2024-55887Ucum-java is a FHIR Java library providing UCUM Services. In…8.6