NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Maven

CVE-2024-56158: XWiki allows SQL injection in query endpoint of REST API with Oracle

criticalCVSS 4.0 9.3GHSA-prwh-7838-xf82

Impact It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. Patches This has been patched in 16.10.2, 16.4.7 and 15.10.16. Workarounds There is no known workaround, other than upgrading XWiki.

Published Jun 12, 2025 · Updated Jan 12, 2026

Affected packages

org.xwiki.platform:xwiki-platform-oldcore

Ecosystem
Maven
Affected
>= 1.0, < 15.10.16
Fixed in
15.10.16
Check
mvn dependency:tree -Dincludes=org.xwiki.platform:xwiki-platform-oldcore

org.xwiki.platform:xwiki-platform-oldcore

Ecosystem
Maven
Affected
>= 16.0.0-rc-1, < 16.4.7
Fixed in
16.4.7
Check
mvn dependency:tree -Dincludes=org.xwiki.platform:xwiki-platform-oldcore

org.xwiki.platform:xwiki-platform-oldcore

Ecosystem
Maven
Affected
>= 16.5.0-rc-1, < 16.10.2
Fixed in
16.10.2
Check
mvn dependency:tree -Dincludes=org.xwiki.platform:xwiki-platform-oldcore

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY.

The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query.

Patches

This has been patched in 16.10.2, 16.4.7 and 15.10.16.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

https://jira.xwiki.org/browse/XWIKI-22734

For more information

If you have any questions or comments about this advisory:

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries