CVE-2024-31984

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-31984
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-31984.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-31984
Aliases
Published
2024-04-10T19:53:50Z
Modified
2025-11-02T12:23:07.522647Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
XWiki Platform: Remote code execution through space title and Solr space facet
Details

XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in XWiki. This allows any user who can edit the title of a space (all users by default) to execute any Groovy code in the XWiki installation which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the Main.SolrSpaceFacet page.

Database specific 
{
    "cwe_ids": [
        "CWE-95"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
5c2d4ea599703742ae5325c7707d1ae926d14d6c
Fixed
38f2695758c691f355913cacbbd0477caa8c1716

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
43c9d551e3c11e9d8f176b556dd33bbe31fc66e0
Fixed
5ef9d294d37be92ee22b2549e38663b29dce8767
Fixed
74e301c481e69eeea674dac7fed6af3614cf08c5
Fixed
94fc12db87c2431eb1335ecb9c2954b1905bde62
Fixed
acba74c149a041345b24dcca52c586f872ba97fb
Fixed
ef55105d6eeec5635fd693f0070c5aaaf3bdd940

Affected versions

xwiki-application-calendar-1.*

xwiki-application-calendar-1.0

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

xwiki-plugin-tag-1.*

xwiki-plugin-tag-1.1