CVE-2024-21650 | XWiki xwiki-platform up to 14.10.16/15.5.2/15.7 User Registration first name/last name neutralization of directives

A vulnerability classified as critical has been found in XWiki xwiki-platform up to 14.10.16/15.5.2/15.7. Affected is an unknown function of the component User Registration Handler. The manipulation of the argument first name/last name leads to improper neutralization of directives in dynamically evaluated code (‘eval injection’).

This vulnerability is traded as CVE-2024-21650. It is possible to launch the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.