CVE-2024-55662: xwiki Auth Bypass — Exploit & Fix

Description

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since `Extension Repository Application` is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page `ExtensionCode.ExtensionSheet` and to the page `ExtensionCode.ExtensionAuthorsDisplayer`.

Is your site exposed to CVE-2024-55662?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.9

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-96 CWE-96

CWE-863 Incorrect Authorization

CWE-94 CWE-94

Affected Products

Vendor	Product	Versions
xwiki	xwiki	3.3 — 15.10.9
xwiki	xwiki	16.0.0 — 16.3.0

References

Advisories & Patches

https://github.com/xwiki/xwiki-platform/commit/8659f17d500522bf33595e402391592a35a162e8 https://jira.xwiki.org/browse/XWIKI-21890 https://jira.xwiki.org/browse/XWIKI-21890

Exploits

https://jira.xwiki.org/browse/XWIKI-21890 https://jira.xwiki.org/browse/XWIKI-21890

Other References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2pq-22jj-4pm5

Frequently Asked Questions

What is CVE-2024-55662? +

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since `Extension Repository Application` is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page `ExtensionCode.ExtensionSheet` and to the page `ExtensionCode.ExtensionAuthorsDisplayer`. It has a CVSS v3.1 base score of 9.9 (CRITICAL).

How severe is CVE-2024-55662? +

CVE-2024-55662 has a CVSS v3.1 score of 9.9 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-55662? +

CVE-2024-55662 affects products from xwiki, specifically: xwiki. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-55662? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-30091

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers …

CVE-2026-68489

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute …

CVE-2015-2079 9.9

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three …

CVE-2024-55877 9.9

XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any …

CVE-2024-13264 9.8

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File …

CVE-2026-86218 9.8

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

CVE-2024-55662