| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | ≥ 1.0, < 16.10.6≥ 17.0.0-rc1, < 17.3.0-rc-1 | 16.10.617.3.0-rc-1 |
| xwiki | ≥ 17.0.0, ≤ 17.2.2< 16.10.6 | 16.10.6 |
It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY.
The XWiki#searchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query (for example in the WHERE).
This has been patched in 16.10.6 and 17.3.0-rc-1.
There is no known workaround, other than upgrading XWiki.
https://jira.xwiki.org/browse/XWIKI-22728
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free