{"id":"CVE-2024-56158","aliases":["GHSA-prwh-7838-xf82"],"url":"https://o3.security/vulnerability/CVE-2024-56158","summary":"XWiki allows SQL injection in query endpoint of REST API with Oracle","details":"XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.","published":"2025-06-12T14:56:56.939Z","modified":"2026-08-08T09:47:44.950848Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-oldcore","fixedVersion":"15.10.16"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-oldcore","fixedVersion":"16.4.7"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-oldcore","fixedVersion":"16.10.2"}],"fix":{"url":"https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d","label":"xwiki/xwiki-platform@ce855aa"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22734"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56158.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56158"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T09:47:44.950848Z"}}