CVE-2024-37901
1 advisory.
Maven/org.xwiki.platform:xwiki-platform-search-ui CVE-2024-37901: critical 9.9
XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
Action: Upgrade org.xwiki.platform:xwiki-platform-search-ui to 14.10.21 (14.10.x), 15.5.5 (15.5.x) or 15.10.2 (15.10.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.2-rc-1 | 14.10.21 | - |
| 15.0-rc-1 | 15.5.5 | - |
| 15.6-rc-1 | 15.10.2 | - |
Fixed versions
| 14.10.21 | 15.5.5 | 15.10.2 |
Sources
- osv: GHSA-h63h-5c77-77p5
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h63h-5c77-77p5
- https://nvd.nist.gov/vuln/detail/CVE-2024-37901
- https://github.com/xwiki/xwiki-platform/commit/0b135760514fef73db748986a3311f3edd4a553b
- https://github.com/xwiki/xwiki-platform/commit/742cd4591642be4cdcaf68325f17540e0934e64e
- https://github.com/xwiki/xwiki-platform/commit/9ce3e0319869b6d8131fc4e0909736f7041566a4
- https://github.com/xwiki/xwiki-platform/commit/bbde8a4f564e3c28839440076334a9093e2b4834
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-21473
CVE-2024-37901 · published · modified · JSON