CVE-2024-21650

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-95 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-216516.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a p CVE-2024-216529.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can explo CVE-2024-216539.8The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation CVE-2024-216549.8Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeo CVE-2024-216554.3Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malici CVE-2024-216584.3discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on regi CVE-2024-21666.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time M CVE-2024-216617.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can explo CVE-2024-216629.1Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effec CVE-2024-216638.8Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord CVE-2024-216647.5jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON ser CVE-2024-216654.3ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orde