CVE-2024-31987

CRITICAL

XWiki Platform remote code execution from account via custom skins support

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-31987 has a selected CVSS score of 10.0 (critical).

Description

XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution. This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1. No known workarounds are available except for upgrading.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 20, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

xwiki-platform

Browse xwiki / xwiki-platform

Default status: unknown

CVE List6.4-milestone-1 to < 14.10.19affected
15.0-rc-1 to < 15.5.4affected
15.6-rc-1 to < 15.10-rc-1affected
>= 6.4-milestone-1, < 14.10.19affected
>= 15.0-rc-1, < 15.5.4affected
>= 15.6-rc-1, < 15.10-rc-1affected

org.xwiki.platform:xwiki-platform-oldcore

Browse Maven / org.xwiki.platform:xwiki-platform-oldcore
GitHub Advisory6.4-milestone-1 to < 14.10.19 · Fixed in 14.10.19affected
15.0-rc-1 to < 15.5.4 · Fixed in 15.5.4affected
15.6-rc-1 to < 15.10-rc-1 · Fixed in 15.10-rc-1affected

References

7