PT-2023-9622 · Xwiki · Xwiki Platform

Akos Jakab + 1 · Published 2023-10-26 · Updated 2025-11-26 · CVE-2024-31982

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 2.4-milestone-1 through 4.10.20 XWiki Platform versions 15.5.4 and earlier XWiki Platform versions 15.10-rc-1 and earlier

Description The issue in XWiki Platform stems from a lack of input validation within the database search functionality. This allows a non-authenticated attacker to achieve remote code execution. The database search is accessible by default to all users, meaning any visitor to a public wiki or user of a closed wiki could potentially exploit this issue, impacting the confidentiality, integrity, and availability of the entire XWiki installation. The vulnerability allows execution of arbitrary code through the search text. The API endpoint involved is /xwiki/bin/get/Main/DatabaseSearch. The vulnerable parameter is text.

Recommendations XWiki Platform versions 2.4-milestone-1 through 4.10.20: Manually apply the patch to the Main.DatabaseSearch page, or delete the page if database search is not explicitly used by users. XWiki Platform versions 15.5.4 and earlier: Manually apply the patch to the Main.DatabaseSearch page, or delete the page if database search is not explicitly used by users. XWiki Platform versions 15.10-rc-1 and earlier: Manually apply the patch to the Main.DatabaseSearch page, or delete the page if database search is not explicitly used by users.

Exploit

Fix

RCE

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

BDU:2024-08879

CVE-2024-31982

GHSA-2858-8CFX-69M9

Affected Products

Xwiki Platform

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31982.json · Exploit
• 🔥 https://github.com/bigb0x/CVE-2024-31982 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-21472 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/xwiki-rce-cve-2024-31982 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2858-8cfx-69m9 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/95bdd6cc6298acdf7f8f21298d40eeb8390a8565 · Patch
• https://github.com/xwiki/xwiki-platform/commit/3c9e4bb04286de94ad24854026a09fa967538e31 · Patch
• https://github.com/xwiki/xwiki-platform/commit/459e968be8740c8abc2a168196ce21e5ba93cfb8 · Patch
• https://osv.dev/vulnerability/GHSA-2858-8cfx-69m9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31982 · Security Note
• https://bdu.fstec.ru/vul/2024-08879 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/K3Ipi3/status/1804437917605224642 · Twitter Post
• https://twitter.com/ET_Labs/status/1904998676449403219 · Twitter Post