GHSA-p9qm-p942-q3w5

Source

https://github.com/advisories/GHSA-p9qm-p942-q3w5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-p9qm-p942-q3w5/GHSA-p9qm-p942-q3w5.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-p9qm-p942-q3w5

Aliases

CVE-2025-54385

Published

2025-07-25T14:11:00Z

Modified

2025-07-28T13:04:55Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

Details

Impact

It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY.

The XWiki#searchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query (for example in the WHERE).

Patches

This has been patched in 16.10.6 and 17.3.0-rc-1.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

https://jira.xwiki.org/browse/XWIKI-22728

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List

Database specific

{
    "github_reviewed": true,
    "severity": "HIGH",
    "github_reviewed_at": "2025-07-25T14:11:00Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-89"
    ],
    "nvd_published_at": "2025-07-26T04:16:06Z"
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0

Fixed

16.10.6

Maven / org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17.0.0-rc1

Fixed

17.3.0-rc-1