XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore(Maven) | 1.0 | 15.10.16 | N/A |
| org.xwiki.platform:xwiki-platform-oldcore(Maven) | 16.0.0-rc-1 | 16.4.7 | N/A |
| org.xwiki.platform:xwiki-platform-oldcore(Maven) | 16.5.0-rc-1 | 16.10.2 | N/A |
CVSS Metrics
