High severity · published Apr 10, 2024
CVE-2024-31987
XWiki Platform is a generic wiki platform
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution. This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1. No known workarounds are available except for upgrading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XW
Xwiki · Xwiki
6.4 before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31987
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31987
Patch
https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39
Patch
https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2
Patch
https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56
Exploit
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cv55-v6rw-7r5v
Exploit
https://jira.xwiki.org/browse/XWIKI-21478
More from Xwiki
9.8
CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
9.9
CVE-2023-27479
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it
9.8
CVE-2026-33229
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
9.8
CVE-2025-54385
XWiki Platform's searchDocuments API allows for SQL injection
9.8
CVE-2025-32429
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter