What is the CVSS score of CVE-2024-21650?

CVE-2024-21650 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 92.5%.

Which versions of Xwiki are affected by CVE-2024-21650?

Organizations using XWiki Platform face critical risk from CVE-2024-21650, a eval injection vulnerability rated CVSS 10.0.. A patch is available.

Is there a public PoC exploit available for CVE-2024-21650?

Yes, a public proof-of-concept exploit is available for CVE-2024-21650. Prioritise patching immediately. EPSS: 92.5%.

How to fix or mitigate CVE-2024-21650?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Vendor patch is available.

Xwiki CVE-2024-21650

CRITICAL

Eval Injection (CWE-95)

2024-01-08 security-advisories@github.com

RCE Code Injection Xwiki

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:34 vuln.today

Patch released

Mar 28, 2026 - 19:34 nvd

Patch available

PoC Detected

Nov 21, 2024 - 08:54 vuln.today

Public exploit code

CVE Published

Jan 08, 2024 - 16:15 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.

AnalysisAI

XWiki Platform prior to specific patched versions contains a CVSS 10.0 remote code execution vulnerability through the user registration form. Attackers inject Groovy code into the first name or last name fields, which is executed server-side when the user profile page is rendered.

Technical ContextAI

XWiki renders user profile pages using its own scripting engine that supports Groovy, Velocity, and Python. The registration form stores first/last name values without sanitizing XWiki macro syntax. When the newly created user's profile page is rendered, any embedded {{groovy}} macros execute with programming rights, allowing arbitrary Java/Groovy code execution on the server.

RemediationAI

Update XWiki to 14.10.20, 15.5.4, or 15.10-rc-1. If immediate patching is not possible, disable user self-registration. Restrict Groovy scripting rights to trusted administrators only. Monitor user profile pages for suspicious macro content.