Digest · Thursday

Security digest: December 12, 2024

4 critical advisories.

Take stock

Maven: 4 critical advisories (org.xwiki.platform:xwiki-platform-administration-ui, org.xwiki.platform:xwiki-platform-repository-server-ui, org.http4k:http4k-format-xml, org.xwiki.platform:xwiki-platform-help-ui). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

XWiki allows RCE from script right in configurable sections CVE-2024-55879 CVSS 9.1 Critical
org.xwiki.platform:xwiki-platform-administration-ui >= 2.3, < 15.10.9 → fixed in 15.10.9; org.xwiki.platform:xwiki-platform-administration-ui >= 16.0.0-rc-1, < 16.3.0 → fixed in 16.3.0
XWiki allows remote code execution through the extension sheet CVE-2024-55662 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-repository-server-ui >= 3.3-milestone-1, < 15.10.9 → fixed in 15.10.9; org.xwiki.platform:xwiki-platform-repository-server-ui >= 16.0.0-rc-1, < 16.3.0 → fixed in 16.3.0
http4k has a potential XXE (XML External Entity Injection) vulnerability CVE-2024-55875 CVSS 9.8 Critical
org.http4k:http4k-format-xml < 6.50.0.0 → fixed in 6.50.0.0
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList CVE-2024-55877 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-help-ui >= 9.7-rc-1, < 15.10.11 → fixed in 15.10.11; org.xwiki.platform:xwiki-platform-help-ui >= 16.0.0-rc-1, < 16.4.1 → fixed in 16.4.1; org.xwiki.platform:xwiki-platform-help-ui >= 16.5.0-rc-1, < 16.5.0 → fixed in 16.5.0