What is the CVSS score of CVE-2024-56158?

CVE-2024-56158 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Xwiki are affected by CVE-2024-56158?

XWiki instances using Oracle databases face critical SQL injection vulnerability allowing unauthorized database access and potential data exfiltration.. A patch is available.

How to fix or mitigate CVE-2024-56158?

Within 24 hours: Identify all XWiki deployments using Oracle databases and assess current version; isolate affected systems from production if running versions prior to 15.10.16, 16.4.7, or 16.10.2. Within 7 days: Apply vendor patches to all XWiki instances or upgrade to patched versions; conduct database access audits for unauthorized query execution. Within 30 days: Implement WAF rules to block suspicious SQL function calls (DBMS_XMLGEN, DBMS_XMLQUERY); enable enhanced logging and monitoring on all XWiki-Oracle connections; perform forensic review of database logs for evidence of exploitation.

Xwiki CVE-2024-56158

EUVD-2024-54677 CRITICAL

SQL Injection (CWE-89)

2025-06-12 security-advisories@github.com

GHSA-prwh-7838-xf82

Oracle Information Disclosure Xwiki

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:20 euvd

EUVD-2024-54677

Analysis Generated

Mar 14, 2026 - 21:20 vuln.today

CVE Published

Jun 12, 2025 - 15:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.

AnalysisAI

Critical SQL injection vulnerability in XWiki that allows unauthenticated remote attackers to execute arbitrary SQL queries against Oracle databases by exploiting insufficient validation of native SQL functions (DBMS_XMLGEN, DBMS_XMLQUERY) in Hibernate query processing. The vulnerability affects XWiki versions before 16.10.2, 16.4.7, and 15.10.16, with a CVSS score of 9.8 indicating critical severity and complete compromise of confidentiality, integrity, and availability. This is a pre-authentication remote code execution vector with no user interaction required.

Technical ContextAI

The vulnerability exists at the intersection of XWiki's query validation layer and Hibernate ORM's native function support. XWiki uses Hibernate for database abstraction, which permits native SQL functions in HQL (Hibernate Query Language) queries. The XWiki query validator fails to properly sanitize or blocklist Oracle-specific functions like DBMS_XMLGEN and DBMS_XMLQUERY, which are privileged PL/SQL packages that can be abused to execute arbitrary SQL. This is rooted in CWE-89 (SQL Injection) where user-controllable input reaches SQL execution contexts without proper parameterization or validation. The root cause is inadequate input validation combined with overly permissive Hibernate function resolution, allowing attackers to bypass intended security controls by leveraging database-native capabilities that the validator does not account for.

RemediationAI

Immediate patching is required: upgrade to XWiki 16.10.2, 16.4.7, or 15.10.16 depending on your current version line. For version 15.x: upgrade to 15.10.16 or later. For version 16.4.x: upgrade to 16.4.7 or later. For version 16.10.x: upgrade to 16.10.2 or later. Interim mitigations pending patch deployment: (1) Restrict network access to XWiki instances using firewall rules or WAF rules that block requests containing suspicious SQL function names (DBMS_XMLGEN, DBMS_XMLQUERY); (2) implement database-level access controls to limit SQL execution capabilities of the XWiki database user account; (3) disable or restrict use of Hibernate native query features if not required by application logic; (4) monitor database logs for suspicious function calls. However, these mitigations are not a substitute for patching and should only be temporary measures.