CVE-2024-31987

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-31987
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31987.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-31987
Aliases
Published
2024-04-10T20:32:39.317Z
Modified
2026-04-02T10:49:12.537075Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
XWiki Platform remote code execution from account via custom skins support
Details

XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution. This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1. No known workarounds are available except for upgrading.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31987.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
8993cfea20309451ea9716727df64529ad136915
Fixed
9d9df1a75094bc677015c7f8321a7e2081662aae
Database specific 
{
    "versions": [
        {
            "introduced": "6.4-milestone-1"
        },
        {
            "fixed": "14.10.19"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
d823334f762d5ad86bea378b65af0b230668d401
Fixed
0e37972524b5a68c44734112f38a48e746b0909e
Database specific 
{
    "versions": [
        {
            "introduced": "15.0-rc-1"
        },
        {
            "fixed": "15.5.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
201a8cdfdaad44618c79c6dd0c0bb855b446aafb
Fixed
2251e39df282f2a8b2b3581063eb75a8f30d5f30
Database specific 
{
    "versions": [
        {
            "introduced": "15.6-rc-1"
        },
        {
            "fixed": "15.10-rc-1"
        }
    ]
}

Affected versions

xwiki-platform-15.*
xwiki-platform-15.0
xwiki-platform-15.0-rc-1
xwiki-platform-15.6
xwiki-platform-15.6-rc-1
xwiki-platform-6.*
xwiki-platform-6.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31987.json"