CVE-2024-21650

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

XWiki Platform is affected by a remote code execution vulnerability that stems from insufficient input sanitization in its user registration feature. The flaw resides in the handling of the first name and last name fields, where specially crafted payloads can trigger arbitrary code execution on the server. All installations that permit guest registration are impacted, and the issue is tracked under CWE-94 and CWE-95 with a CVSS score of 10.0.

An unauthenticated attacker can exploit the vulnerability simply by completing the self-registration form with malicious content in either name field. Successful exploitation grants the attacker the ability to run arbitrary code within the XWiki runtime, potentially leading to full compromise of the underlying server and any hosted applications.

Official advisories and the linked GitHub security notice recommend upgrading to the patched releases XWiki 14.10.17, 15.5.3, or 15.8 RC1. The corresponding commits that address the input validation gaps are published in the project repository, and administrators are advised to apply the updates promptly or restrict guest registration until patches can be deployed.

The EPSS score currently stands at 0.9254 with a recorded peak of 0.9346, indicating sustained and elevated exploitation interest following disclosure.