High severity · published Apr 10, 2024
CVE-2024-31997
XWiki Platform is a generic wiki platform
8.8
CVSS
73.9%
EPSS
No
On KEV
Description
XWiki Platform is a generic wiki platform. Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user's own profile can create UI extensions. This allows remote code execution and thereby impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.19, 15.5.4 and 15.9-RC1. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)73.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XW
Xwiki · Xwiki
before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31997
Patch
https://github.com/xwiki/xwiki-platform/commit/171e7c7d0e56deaa7b3678657ae26ef95379b1ea
Patch
https://github.com/xwiki/xwiki-platform/commit/1b2574eb966457ca4ef34e557376b8751d1be90d
Patch
https://github.com/xwiki/xwiki-platform/commit/56748e154a9011f0d6239bec0823eaaeab6ec3f7
Exploit
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c2gg-4gq4-jv5j
Exploit
https://jira.xwiki.org/browse/XWIKI-21335
More from Xwiki
9.8
CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
9.9
CVE-2023-27479
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it
9.8
CVE-2026-33229
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
9.8
CVE-2025-54385
XWiki Platform's searchDocuments API allows for SQL injection
9.8
CVE-2025-32429
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter