CVE-2024-21650criticalobserved exploitationCWE-95

CVE-2024-21650: critical vulnerability in xwiki-platform

XWiki Remote Code Execution vulnerability via user registration

Published · Updated

87Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 10epss 93%
from disclosure to weapon
Published on NVDJan 8
VulnCheck+626d
exploitation probability
93%top 1% of all CVEs
observed exploitation
yesVulnCheck
In short

XWiki allows attackers to run malicious code during user registration by entering specially crafted text in name fields. This is critical because anyone can register and take over the system if registration is open to guests.

Technical detail

CWE-95 (Code Injection) vulnerability in XWiki's user registration endpoint allows arbitrary code execution via unsanitized input in first name and last name parameters. Exploitation requires only network access to an instance with guest registration enabled; the injected payload is executed with application privileges, enabling complete system compromise.

Summary generated and translated by AI from the official description.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
xwiki · xwiki-platform
Related CVEs — xwiki-platform

In the same product, most dangerous first.

CVE-2025-24893CRITICALRemote code execution as guest via SolrSearchMacros request in xwikiEPSS 99.9%KEVCVE-2023-37462CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiEPSS 91.6%CVE-2023-46731CRITICALRemote code execution through the section parameter in Administration as guest in XWiki PlatformEPSS 88.5%CVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 87.1%CVE-2023-50719HIGHXWiki Platform Solr search discloses password hashes of all usersEPSS 83.5%CVE-2024-31984CRITICALXWiki Platform: Remote code execution through space title and Solr space facetEPSS 83.0%
References
https://github.com/xwiki/xwiki-platform/commit/b290bfd573c6f7db6cc15a88dd4111d9fcad0d31https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rj7p-xjv7-7229https://jira.xwiki.org/browse/XWIKI-21173