CVE-2024-55876

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-55876
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55876.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-55876
Aliases
Published
2024-12-12T18:59:49.733Z
Modified
2026-07-22T03:35:49.911944Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
XWiki's scheduler in subwiki allows scheduling operations for any main wiki user
Details

XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document Scheduler.WebHome in a subwiki. Then, click on any operation (e.g., Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on Scheduler.WebPreferences to match the patch.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55876.json",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3f100aee4c197e68d2986717a878d0bbd4fb0c22
Introduced
918ea43fe0d277c28efa21a871175b329c75157c
Fixed
ed06afe4614a2782ddac6e42ed21f180056a206e
Introduced
99d58d81092b47c5076d07041c1beec93f07d051
Last affected
99d58d81092b47c5076d07041c1beec93f07d051
Database specific 
{
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:*:-:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:1.2:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.2.1"
        },
        {
            "fixed": "15.10.9"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.3.0"
        },
        {
            "introduced": "1.2-NA"
        },
        {
            "last_affected": "1.2-NA"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
b8d53d613cc472054198880bf2720ce3884d926a
Fixed
1c4b9ba5f04cd8d636a6718465a0b8e251f51420
Introduced
3c6f5cf138d8095f63631e554ba448e4b780e162
Fixed
50fb1f191827504c6173697d6c39aa093301a851
Introduced
a68e2d6f3d26bf76499502626f29ca0138f62089
Fixed
54bcc5a7a2e440cc591b91eece9c13dc0c487331
Database specific 
{
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:*:-:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:1.2:-:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:1.2:milestone2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.2.1"
        },
        {
            "fixed": "15.10.9"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.3.0"
        },
        {
            "introduced": "1.2-NA"
        },
        {
            "last_affected": "1.2-NA"
        },
        {
            "introduced": "1.2-milestone2"
        },
        {
            "last_affected": "1.2-milestone2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.2-NA
1.2-milestone2
xwiki-commons-15.*
xwiki-commons-15.10
xwiki-commons-15.10-rc-1
xwiki-commons-15.10.1
xwiki-commons-15.10.2
xwiki-commons-15.10.3
xwiki-commons-15.10.4
xwiki-commons-15.10.5
xwiki-commons-15.10.6
xwiki-commons-15.10.7
xwiki-commons-15.10.8
xwiki-commons-16.*
xwiki-commons-16.3.0-rc-1
xwiki-commons-8.*
xwiki-commons-8.0-milestone-1
xwiki-commons-8.0-milestone-2
xwiki-commons-8.1-milestone-1
xwiki-commons-8.1-milestone-2
xwiki-commons-8.2-milestone-1
xwiki-commons-8.2-milestone-2
xwiki-commons-8.3-milestone-1
xwiki-commons-8.3-milestone-2
xwiki-commons-license-resources-1.*
xwiki-commons-license-resources-1.2

Database specific

vanir_signatures_modified 
"2026-07-22T03:35:49Z"
vanir_signatures 
[
    {
        "target": {
            "function": "setUp",
            "file": "xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-ui/src/test/java/org/xwiki/scheduler/ui/SchedulerPageTest.java"
        },
        "id": "CVE-2024-55876-64018ff1",
        "digest": {
            "function_hash": "320699107581045178202029475314457317510",
            "length": 1349.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331"
    },
    {
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-ui/src/test/java/org/xwiki/scheduler/ui/SchedulerPageTest.java"
        },
        "id": "CVE-2024-55876-984dcf7a",
        "digest": {
            "line_hashes": [
                "46160026413921582650173818823406653908",
                "53394366996646667747230855980354624906",
                "328475681764110367668589555051324554285",
                "93757110941715075689404303730189585394",
                "2945587470618018015807513154073979190",
                "223659179877606088847008751106187876147",
                "117590846199278513449966482990812237134",
                "43376088918460774220711317085128669976",
                "298879766897520214873839442708812904055",
                "275296427927977162491138040574253409185",
                "32716400321826755511660945267566513297",
                "9101197268986673535591384068308652669",
                "135547552173379052912357377076235266742",
                "173665972753598113912933213513314952833",
                "201731330622560764930679738265060345690",
                "163667138149446606057957718696297844299",
                "133418458471533577780772821660904057879",
                "206941301287037684489017932711097277881",
                "166173430592326304272808121030693592298",
                "139291846678229305091523637256576183177",
                "321866523414477752185910432791875176648",
                "328233122640759864520580522136597488730",
                "75507021343667284522501236673242030840",
                "86621556755989173500902081581790208064"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55876.json"