CVE-2024-37901 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-95** (Improper Neutralization of Code). 🔍 **Flaw**: The system fails to properly sanitize user input when adding instances to user profiles or pages, allowing malicious code injection.

Q: Who is affected? (Versions/Components)

📦 **Affected Versions**: • 9.2-rc-1 to 14.10.21 • 15.0-rc-1 to 15.5.5 • 15.6-rc-1 to 15.10.2 ⚠️ **Product**: XWiki Platform (Open Source Wiki).

Q: What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: • Execute **Arbitrary Remote Code**. • Gain **High Privileges** (CVSS A:H, I:H, C:H). • Access sensitive data and modify system integrity.

Q: Is exploitation threshold high? (Auth/Config)

🔐 **Exploitation Threshold**: • **Auth Required**: Yes (PR:L). • **Condition**: User must have **Edit Permissions**. • **UI Required**: No (UI:N). 📉 **Difficulty**: Low for authenticated editors.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Identify XWiki version. 2. Check if version falls in affected ranges. 3. Review user permissions for 'Edit' access. 4. Scan for code injection in user profiles.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Official Fix**: • **Status**: Fixed via GitHub commits (e.g., 742cd45, bbde8a4). • **Action**: Upgrade to versions **14.10.21+**, **15.5.5+**, or **15.10.2+**.

Q: Is it urgent? (Priority Suggestion)

⚡ **Urgency**: **HIGH**. • **CVSS Score**: High (9.8+ implied by vector). • **Priority**: Immediate patching recommended for all affected versions. RCE is critical.

Updated May 08, 2026 CVSS 10.0 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: XWiki Platform allows arbitrary Remote Code Execution (RCE) via user profiles.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-95** (Improper Neutralization of Code). <br>🔍 **Flaw**: The system fails to properly sanitize user input when adding instances to user profiles or pages, allowing malicious code injection.

Q3Who is affected? (Versions/Components)

📦 **Affected Versions**: <br>• 9.2-rc-1 to 14.10.21 <br>• 15.0-rc-1 to 15.5.5 <br>• 15.6-rc-1 to 15.10.2 <br>⚠️ **Product**: XWiki Platform (Open Source Wiki).

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: <br>• Execute **Arbitrary Remote Code**. <br>• Gain **High Privileges** (CVSS A:H, I:H, C:H). <br>• Access sensitive data and modify system integrity.

Q5Is exploitation threshold high? (Auth/Config)

🔐 **Exploitation Threshold**: <br>• **Auth Required**: Yes (PR:L). <br>• **Condition**: User must have **Edit Permissions**. <br>• **UI Required**: No (UI:N). <br>📉 **Difficulty**: Low for authenticated editors.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: <br>• **PoC Status**: No specific PoC listed in data (pocs: []). <br>• **Wild Exploitation**: Likely low initially, but RCE risks are high once authenticated.…

Read full answer (login)

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Identify XWiki version. <br>2. Check if version falls in affected ranges. <br>3. Review user permissions for 'Edit' access. <br>4. Scan for code injection in user profiles.

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Official Fix**: <br>• **Status**: Fixed via GitHub commits (e.g., 742cd45, bbde8a4). <br>• **Action**: Upgrade to versions **14.10.21+**, **15.5.5+**, or **15.10.2+**.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>• **Restrict Permissions**: Remove 'Edit' rights for untrusted users. <br>• **Input Validation**: Manually sanitize user profile fields.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

⚡ **Urgency**: **HIGH**. <br>• **CVSS Score**: High (9.8+ implied by vector). <br>• **Priority**: Immediate patching recommended for all affected versions. RCE is critical.

Continue exploring

Vulnerability detail Full AI analysis (login) xwiki CWE-95