PT-2024-24335 · Xwiki · Xwiki Platform

Michael Hamann · Published 2023-04-18 · Updated 2025-01-23 · CVE-2024-31985

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 3.1 through 4.10.19 XWiki Platform versions 14.10.18 and earlier XWiki Platform versions 15.5.4 and earlier XWiki Platform version 15.10-rc-1 and earlier

Description The issue allows an attacker to schedule, trigger, or unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL. This can be achieved by embedding such a URL in any content as an image. The vulnerability can be exploited by visiting a specific API endpoint, for example, <xwiki-host>:/xwiki/bin/view/Scheduler/?do=trigger&which=Scheduler.NotificationEmailDailySender, as a user with admin rights. If there is no error message indicating the CSRF token is invalid, the installation is vulnerable.

Recommendations For XWiki Platform versions 3.1 through 4.10.19, update to version 4.10.20 or later. For XWiki Platform versions 14.10.18 and earlier, update to version 14.10.19 or later. For XWiki Platform versions 15.5.4 and earlier, update to version 15.5.5 or later. For XWiki Platform version 15.10-rc-1 and earlier, update to version 15.9 or later. As a temporary workaround, manually apply the patch by modifying the Scheduler.WebHome page.

Exploit

Fix

Incorrect Authorization

Missing Authorization

CSRF

Weakness Enumeration

CWE-863

CWE-862

CWE-352

Related Identifiers

BDU:2025-12950

CVE-2024-31985

GHSA-J2R6-R929-V6GF

Affected Products

Xwiki Platform

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31985.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2r6-r929-v6gf · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269 · Patch
• https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf · Patch
• https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c · Patch
• https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-31985 · Security Note
• https://osv.dev/vulnerability/GHSA-j2r6-r929-v6gf · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20851 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12950 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31985 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/76330 · Telegram Post
• https://twitter.com/CVEnew/status/1778263599645065469 · Twitter Post
• https://t.me/cvenotify/76430 · Telegram Post