| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | ≥ 1.0, < 15.10.16≥ 16.0.0-rc-1, < 16.4.7≥ 16.5.0-rc-1, < 16.10.2 | 15.10.1616.4.716.10.2 |
| xwiki | ≥ 1.0, < 15.10.16≥ 16.0.0, < 16.4.7≥ 16.5.0, < 16.10.2 | 15.10.1616.4.716.10.2 |
It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY.
The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query.
This has been patched in 16.10.2, 16.4.7 and 15.10.16.
There is no known workaround, other than upgrading XWiki.
https://jira.xwiki.org/browse/XWIKI-22734
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free