CVE-2024-31987
XWiki Platform remote code execution from account via custom skins support
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution. This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1. No known workarounds are available except for upgrading.
XWiki Platform es una plataforma wiki genérica. A partir de la versión 6.4-milestone-1 y antes de las versiones 4.10.19, 15.5.4 y 15.10-rc-1, cualquier usuario que pueda editar cualquier página como su perfil puede crear una máscara personalizada con una anulación de plantilla que se ejecuta con derecho de programación, permitiendo así la ejecución remota de código. Esto ha sido parcheado en XWiki 14.10.19, 15.5.4 y 15.10RC1. No hay workarounds disponibles excepto la actualización.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-04-08 CVE Reserved
- 2024-04-10 CVE Published
- 2024-04-11 EPSS Updated
- 2024-08-20 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-862: Missing Authorization
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39 | X_refsource_misc | |
| https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2 | X_refsource_misc | |
| https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56 | X_refsource_misc | |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cv55-v6rw-7r5v | X_refsource_confirm | |
| https://jira.xwiki.org/browse/XWIKI-21478 | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Xwiki Search vendor "Xwiki" | Xwiki-platform Search vendor "Xwiki" for product "Xwiki-platform" | >= 6.4.0 < 14.10.19 Search vendor "Xwiki" for product "Xwiki-platform" and version " >= 6.4.0 < 14.10.19" | en |
Affected
| ||||||
| Xwiki Search vendor "Xwiki" | Xwiki-platform Search vendor "Xwiki" for product "Xwiki-platform" | >= 15.0.0 < 15.5.4 Search vendor "Xwiki" for product "Xwiki-platform" and version " >= 15.0.0 < 15.5.4" | en |
Affected
| ||||||
| Xwiki Search vendor "Xwiki" | Xwiki-platform Search vendor "Xwiki" for product "Xwiki-platform" | >= 15.6 < 15.10 Search vendor "Xwiki" for product "Xwiki-platform" and version " >= 15.6 < 15.10" | en |
Affected
| ||||||