CVE-2024-55876
- Source
- https://cve.org/CVERecord?id=CVE-2024-55876
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55876.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-55876
- Aliases
- Published
- 2024-12-12T18:59:49.733Z
- Modified
- 2026-02-21T06:44:48.953966Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
- Summary
- XWiki's scheduler in subwiki allows scheduling operations for any main wiki user
- Details
-
XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document
Scheduler.WebHomein a subwiki. Then, click on any operation (e.g., Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects onScheduler.WebPreferencesto match the patch. - Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55876.json", "cwe_ids": [ "CWE-862" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55876.json
- https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6
- https://jira.xwiki.org/browse/XWIKI-21663
- https://nvd.nist.gov/vuln/detail/CVE-2024-55876