PT-2023-9622 · Xwiki · Xwiki Platform

Akos Jakab + 1 · Publicado 2023-10-26 · Atualizado 2025-11-26 · CVE-2024-31982

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 2.4-milestone-1 through 4.10.20 XWiki Platform versions 15.5.4 and earlier XWiki Platform versions 15.10-rc-1 and earlier

Description The issue in XWiki Platform stems from a lack of input validation within the database search functionality. This allows a non-authenticated attacker to achieve remote code execution. The database search is accessible by default to all users, meaning any visitor to a public wiki or user of a closed wiki could potentially exploit this issue, impacting the confidentiality, integrity, and availability of the entire XWiki installation. The vulnerability allows execution of arbitrary code through the search text. The API endpoint involved is /xwiki/bin/get/Main/DatabaseSearch. The vulnerable parameter is text.

Recommendations XWiki Platform versions 2.4-milestone-1 through 4.10.20: Manually apply the patch to the Main.DatabaseSearch page, or delete the page if database search is not explicitly used by users. XWiki Platform versions 15.5.4 and earlier: Manually apply the patch to the Main.DatabaseSearch page, or delete the page if database search is not explicitly used by users. XWiki Platform versions 15.10-rc-1 and earlier: Manually apply the patch to the Main.DatabaseSearch page, or delete the page if database search is not explicitly used by users.

Exploit

Correção

RCE

Code Injection

Eval Injection

Enumeração de Fraquezas

CWE-94

CWE-95

Identificadores relacionados

BDU:2024-08879

CVE-2024-31982

GHSA-2858-8CFX-69M9

Produtos afetados

Xwiki Platform

Referências · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31982.json · Exploit
• 🔥 https://github.com/bigb0x/CVE-2024-31982 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-21472 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/xwiki-rce-cve-2024-31982 · Exploit
• https://github.com/xwiki/xwiki-platform · Nota
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2858-8cfx-69m9 · Aviso do Fabricante
• https://github.com/xwiki/xwiki-platform/commit/95bdd6cc6298acdf7f8f21298d40eeb8390a8565 · Correção
• https://github.com/xwiki/xwiki-platform/commit/3c9e4bb04286de94ad24854026a09fa967538e31 · Correção
• https://github.com/xwiki/xwiki-platform/commit/459e968be8740c8abc2a168196ce21e5ba93cfb8 · Correção
• https://twitter.com/K3Ipi3/status/1804437917605224642 · Publicação no Twitter
• https://twitter.com/ET_Labs/status/1904998676449403219 · Publicação no Twitter
• https://vicarius.io/vsociety/posts/cve-2024-31982-xwiki-mitigation-vulnerability · Nota
• https://twitter.com/VulmonFeeds/status/1778201863973679374 · Publicação no Twitter
• https://t.me/cveNotify/136426 · Publicação no Telegram
• https://t.me/cvenotify/108049 · Publicação no Telegram