CVE-2024-31465

xwiki

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-31465

Katalog CVE

CVSS 8.8 · High EPSS 75,6%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada xwiki. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the document `XWiki.SearchSuggestSourceSheet`.

Rincian

Terbit di NVD
10 April 2024
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari)
75,6% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
xwiki xwiki Versi 5.3 hingga sebelum 14.10.20
xwiki xwiki Versi 15.0 hingga sebelum 15.5.4
xwiki xwiki Versi 15.6 hingga sebelum 15.10
xwiki xwiki Versi 5.2
xwiki xwiki Versi 5.2 milestone2
xwiki xwiki Versi 5.2 rc1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.