ZDI-CAN-23994: ZDI-24-1697: XWiki.org XWiki SolrSearchMacros text Command Injection Remote Code Execution Vulnerability
Published Dec 19, 2024
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of XWiki.org XWiki. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
Affected Software
1 affected component
XWiki xwiki
Event History
Dec 19, 2024
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-23994?
ZDI-CAN-23994 has a CVSS rating of 9.8, indicating a critical severity level.
2
What systems are affected by ZDI-CAN-23994?
ZDI-CAN-23994 affects installations of XWiki.org XWiki without any authentication requirements.
3
How do I fix ZDI-CAN-23994?
To fix ZDI-CAN-23994, update your XWiki installation to the latest patched version provided by XWiki.
4
Can ZDI-CAN-23994 be exploited remotely?
Yes, ZDI-CAN-23994 can be exploited remotely as it does not require authentication.
5
What type of attack does ZDI-CAN-23994 enable?
ZDI-CAN-23994 allows remote attackers to execute arbitrary code on affected installations.