CVE-2024-37901: 
Java vulnerability analysis and mitigation

CVE-2024-37901 affects XWiki Platform, a generic wiki platform offering runtime services for applications. The vulnerability was discovered and disclosed on July 31, 2024, affecting versions from 9.2 up to (excluding) 14.10.21, 15.0 up to (excluding) 15.5.5, and 15.6 up to (excluding) 15.10.2. This vulnerability has been patched in XWiki versions 14.10.21, 15.5.5, and 15.10.2 (Vendor Advisory).

The vulnerability allows any user with edit rights on any page to perform arbitrary remote code execution by adding instances of XWiki.SearchSuggestConfig and XWiki.SearchSuggestSourceClass to their user profile or any other page. The vulnerability is rated as Critical with a CVSS v3.1 base score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The weakness types associated with this vulnerability are CWE-94 (Improper Control of Generation of Code), CWE-862 (Missing Authorization), and CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) (NVD).

The vulnerability compromises the confidentiality, integrity, and availability of the whole XWiki installation. When exploited, it allows attackers to escalate privileges from a simple account to programming rights, effectively gaining unauthorized access to sensitive system functions (Vendor Advisory).

The vulnerability can be exploited by users with edit rights by adding specific objects to their user profile or any other editable page. A proof of concept exists that demonstrates the escalation from a simple account to programming rights by setting specific values in the SearchSuggestSourceClass object properties (XWIKI-21473).

The primary mitigation is to upgrade to the patched versions: XWiki 14.10.21, 15.5.5, or 15.10.2. No other workarounds are currently known or available (Vendor Advisory).