{"id":"CVE-2024-55877","aliases":["GHSA-2r87-74cx-2p7c"],"url":"https://o3.security/vulnerability/CVE-2024-55877","summary":"XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList","details":"### Impact\nAny user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation.\n\nTo reproduce on a instance, as a connected user without script nor programming rights, go to your user profile and add an object of type `XWiki.WikiMacroClass`. Set \"Macro Id\", \"Macro Name\" and \"Macro Code\" to any value, \"Macro Visibility\" to `Current User` and \"Macro Description\" to `{{async}}{{groovy}}println(\"Hello from User macro!\"){{/groovy}}{{/async}}`.\nSave the page, then go to `<host>/xwiki/bin/view/XWiki/XWikiSyntaxMacrosList`.\nIf the description of your new macro reads \"Hello from User macro!\", then your instance is vulnerable.\n\n### Patches\nThis vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0.\n\n### Workarounds\nIt is possible to manually apply [this patch](https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3#diff-92fee29683e671b8bc668e3cf4295713d6259f715e3954876049f9de77c0a9ef) to the page `XWiki.XWikiSyntaxMacrosList`.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-22030\n* https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3","published":"2024-12-12T19:13:43.128Z","modified":"2026-10-28T10:54:51.100161542Z","cvss":{"score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":{"score":0.01558,"percentile":0.7399,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-help-ui","fixedVersion":"15.10.11"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-help-ui","fixedVersion":"16.4.1"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-help-ui","fixedVersion":"16.5.0"}],"fix":{"url":"https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3","label":"xwiki/xwiki-platform@40e1afe"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22030"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55877.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2r87-74cx-2p7c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55877"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T10:54:51.100161542Z"}}