PT-2024-24333 · Xwiki · Xwiki Platform

Michael Hamann · CVE-2024-31981 · Published 2023-09-21 · Updated 2025-01-21

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 3.0.1 through 4.10.19 XWiki Platform versions 14.10.19 and earlier XWiki Platform versions 15.5.3 and earlier XWiki Platform versions prior to 15.10-rc-1

Description XWiki Platform is a generic wiki platform. Remote code execution is possible via PDF export templates. This issue has been patched in XWiki 14.10.20, 15.5.4, and 15.10-rc-1.

Recommendations For XWiki Platform versions 3.0.1 through 4.10.19, update to version 4.10.20 or later. For XWiki Platform versions 14.10.19 and earlier, update to version 14.10.20 or later. For XWiki Platform versions 15.5.3 and earlier, update to version 15.5.4 or later. For XWiki Platform versions prior to 15.10-rc-1, update to version 15.10-rc-1 or later. As a temporary workaround, if PDF templates are not typically used on the instance, an administrator can create the document XWiki.PDFClass and block its edition, after making sure that it does not contain a style attribute.

Exploit

Fix

DoS

RCE

Incorrect Authorization

Missing Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-862

CWE-285

Related Identifiers

BDU:2025-04025

CVE-2024-31981

GHSA-VXWR-WPJV-QJQ7

Affected Products

Xwiki Platform

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31981.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-21337 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxwr-wpjv-qjq7 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/d28e21a670c69880b951e415dd2ddd69d273eae9 · Patch
• https://github.com/xwiki/xwiki-platform/commit/a4ad14d9c1605a5ab957237e505ebbb29f5b9d73 · Patch
• https://github.com/xwiki/xwiki-platform/commit/480186f9d2fca880513da8bc5a609674d106cbd3 · Patch
• https://osv.dev/vulnerability/GHSA-vxwr-wpjv-qjq7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04025 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31981 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/VulmonFeeds/status/1778200597683986866 · Twitter Post
• https://twitter.com/CVEnew/status/1778263604124618846 · Twitter Post
• https://t.me/cvenotify/76423 · Telegram Post
• https://t.me/cvenotify/108048 · Telegram Post