CVE-2024-31986

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-31986
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31986.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-31986
Aliases
Published
2024-04-10T20:27:29.600Z
Modified
2026-03-12T02:59:56.402102Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
XWiki Platform CSRF remote code execution through scheduler job's document reference
Details

XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special crafted documented reference and an XWiki.SchedulerJobClass XObject, it is possible to execute arbitrary code on the server whenever an admin visits the scheduler page or the scheduler page is referenced, e.g., via an image in a comment on a page in the wiki. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, apply the patch manually by modifying the Scheduler.WebHome page.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-352",
        "CWE-95"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31986.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
2b519b49ebf592a81c9ff97499212d74d3387bf2
Fixed
9d9df1a75094bc677015c7f8321a7e2081662aae
Database specific 
{
    "versions": [
        {
            "introduced": "3.1"
        },
        {
            "fixed": "14.10.19"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
d823334f762d5ad86bea378b65af0b230668d401
Fixed
0e37972524b5a68c44734112f38a48e746b0909e
Database specific 
{
    "versions": [
        {
            "introduced": "15.0-rc-1"
        },
        {
            "fixed": "15.5.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
201a8cdfdaad44618c79c6dd0c0bb855b446aafb
Fixed
7a8f9b1236bc9271b607fb92e700377e37f67cf2
Database specific 
{
    "versions": [
        {
            "introduced": "15.6-rc-1"
        },
        {
            "fixed": "15.9"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31986.json"