--- title: "Security digest: December 12, 2024" url: https://erroneo.us/security/2024-12-12/ description: "December 12, 2024 vulnerability digest: 4 critical advisories (Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-12-12 date_modified: 2024-12-12 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: December 12, 2024 4 critical advisories. ## Take stock - Maven: 4 critical advisories ( org.xwiki.platform:xwiki-platform-administration-ui , org.xwiki.platform:xwiki-platform-repository-server-ui , org.http4k:http4k-format-xml , org.xwiki.platform:xwiki-platform-help-ui ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-55879](https://erroneo.us/security/cve/CVE-2024-55879/index.md) XWiki allows RCE from script right in configurable sections — Maven org.xwiki.platform:xwiki-platform-administration-ui >= 2.3, < 15.10.9 → 15.10.9; Maven org.xwiki.platform:xwiki-platform-administration-ui >= 16.0.0-rc-1, < 16.3.0 → 16.3.0 - [CVE-2024-55662](https://erroneo.us/security/cve/CVE-2024-55662/index.md) XWiki allows remote code execution through the extension sheet — Maven org.xwiki.platform:xwiki-platform-repository-server-ui >= 3.3-milestone-1, < 15.10.9 → 15.10.9; Maven org.xwiki.platform:xwiki-platform-repository-server-ui >= 16.0.0-rc-1, < 16.3.0 → 16.3.0 - [CVE-2024-55875](https://erroneo.us/security/cve/CVE-2024-55875/index.md) http4k has a potential XXE (XML External Entity Injection) vulnerability — Maven org.http4k:http4k-format-xml < 6.50.0.0 → 6.50.0.0 - [CVE-2024-55877](https://erroneo.us/security/cve/CVE-2024-55877/index.md) XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList — Maven org.xwiki.platform:xwiki-platform-help-ui >= 9.7-rc-1, < 15.10.11 → 15.10.11; Maven org.xwiki.platform:xwiki-platform-help-ui >= 16.0.0-rc-1, < 16.4.1 → 16.4.1; Maven org.xwiki.platform:xwiki-platform-help-ui >= 16.5.0-rc-1, < 16.5.0 → 16.5.0 --- Source page: https://erroneo.us/security/2024-12-12/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt