CVE-2024-21650

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Jan 8, 2024
Updated: Jan 11, 2024
CWE ID 94
CWE ID 95

Summary

CVE-2024-21650 is a remote code execution (RCE) vulnerability affecting the XWiki Platform, a generic wiki solution for application development. The flaw lies in the user registration feature, which is vulnerable to malicious payloads inserted in the "first name" or "last name" fields. An attacker can exploit this vulnerability to execute arbitrary code, impacting all installations with guest user registration enabled. This serious issue has been addressed through patches in XWiki versions 14.10.17, 15.5.3, and 15.8 RC1. Users are advised to apply these updates to protect their systems from potential attacks.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share