The host is running XWiki Enterprise and is prone to unspecified SQL injection and cross site scripting vulnerabilities.

Successful exploitation will allow attacker to execute arbitrary script code or cause SQL Injection attack and gain sensitive information. Impact Level: Application

Upgrade to XWiki Enterprise 2.5 or later, For updates refer to http://enterprise.xwiki.org/xwiki/bin/view/Main/

The flaws are caused by input validation errors when processing user-supplied data and parameters, which could allow remote attackers to execute arbitrary script code or manipulate SQL queries by injecting arbitrary SQL code.

XWiki Enterprise before 2.5

• http://secunia.com/advisories/42058
• http://www.osvdb.org/68976
• http://www.osvdb.org/68977
• http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWikiEnterprise25

---

Updated on 2015-03-25