{"cve":"CVE-2024-55663","nvd":{"published":"2024-12-12T19:15:13.827","modified":"2026-06-17T08:11:22.150","status":"Analyzed","description":"XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering of the returned documents is defined from an unsanitized request parameter (request.sort) and can allow any user to inject HQL. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This has been patched in 13.10.5 and 14.3-rc-1. There is no known workaround, other than upgrading XWiki.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.6},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-116"],"references":["https://github.com/xwiki/xwiki-platform/commit/673076e2e8b88a36cdeaf7007843aa9ca1a068a0","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398","https://jira.xwiki.org/browse/XWIKI-17568"],"products":["xwiki:xwiki"],"source":"nvd","synced_at":"2026-10-19T21:57:36.180738747+00:00"},"epss":{"cve":"CVE-2024-55663","score":0.0075,"percentile":0.54961,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-wh34-m772-5398","url":"https://osv.dev/vulnerability/GHSA-wh34-m772-5398","summary":"XWiki Platform has an SQL injection in getdocuments.vm with sort parameter","modified":"2026-02-04T02:41:15.264367Z","packages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-distribution-war","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-distribution-war","ranges":[">=6.3-milestone-2 <13.10.5"],"fixed":["13.10.5"]},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-distribution-war","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-distribution-war","ranges":[">=14.0-rc-1 <14.3-rc-1"],"fixed":["14.3-rc-1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}