Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-55879
CVE-2024-55879:
Java vulnerability analysis and mitigation
Overview
XWiki Platform, a generic wiki platform, was found to contain a critical remote code execution vulnerability (CVE-2024-55879). Starting in version 2.3 and prior to versions 15.10.9 and 16.3.0, any user with script rights could perform arbitrary remote code execution by adding instances of XWiki.ConfigurableClass to any page. The vulnerability was discovered and disclosed on December 12, 2024 (GitHub Advisory).
Technical details
The vulnerability stems from insufficient security controls in the ConfigurableClass functionality. Users with script rights could exploit this by adding an object of type XWiki.ConfigurableClass to any editable page and manipulating the 'Heading' field to execute arbitrary code. The vulnerability has been assigned a CVSS v3.1 score of 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating network accessibility, low attack complexity, but requiring high privileges (GitHub Advisory).
Impact
This vulnerability compromises the confidentiality, integrity, and availability of the entire XWiki installation. When successfully exploited, it allows attackers to execute arbitrary code with the potential to access sensitive information, modify system data, or disrupt service availability (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in XWiki versions 15.10.9 and 16.3.0. No known workarounds are available except upgrading to these patched versions (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management