CVE-2024-31997: xwiki — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2024-31997

CVSS 8.8 · High EPSS 73,9%

Kerentanan Missing Authorization pada xwiki. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform. Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user's own profile can create UI extensions. This allows remote code execution and thereby impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.19, 15.5.4 and 15.9-RC1. No known workarounds are available.

Rincian

Terbit di NVD: 10 April 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 73,9% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xwiki	xwiki	Semua versi sebelum 14.10.19
xwiki	xwiki	Versi 15.0 hingga sebelum 15.5.4
xwiki	xwiki	Versi 15.6 hingga sebelum 15.9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c2gg-4gq4-jv5j exploit · advisory vendor
https://jira.xwiki.org/browse/XWIKI-21335 exploit · advisory vendor
https://github.com/xwiki/xwiki-platform/commit/171e7c7d0e56deaa7b3678657ae26ef95379b1ea patch
https://github.com/xwiki/xwiki-platform/commit/1b2574eb966457ca4ef34e557376b8751d1be90d patch
https://github.com/xwiki/xwiki-platform/commit/56748e154a9011f0d6239bec0823eaaeab6ec3f7 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.