CVE-2024-31987
highpriority · track · 36OT risk · elevatedEPSS 0.014 · 73 %ileEUUSEPSS · scored 2026-10-28
XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution. This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1. No known workarounds are available except for upgrading.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–10
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (10)
Products and version ranges known to be affected.
- Maven org.xwiki.platform:xwiki-platform-oldcore15.0-rc-1 → 15.5.4osvUSpkg:maven/org.xwiki.platform/xwiki-platform-oldcore
- Maven org.xwiki.platform:xwiki-platform-oldcore15.6-rc-1 → 15.10-rc-1osvUSpkg:maven/org.xwiki.platform/xwiki-platform-oldcore
- Maven org.xwiki.platform:xwiki-platform-oldcore6.4-milestone-1 → 14.10.19osvUSpkg:maven/org.xwiki.platform/xwiki-platform-oldcore
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-cv55-v6rw-7r5vXWiki Platform remote code execution from account via custom skins support2024-04-10ghsa · osvUS
### Impact Any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution. To reproduce, as a user without edit, script or admin right, add an object of class `XWiki.XWikiSkins` to your profile. Name it whatever you want and set the Base Skin to `flamingo`. Add an object of class `XWikiSkinFileOverrideClass` and set the path to `macros.vm` and the content to: ``` #macro(mediumUserAvatar $username) #resizedUserAvatar($username 50) $services.logging.getLogger('Skin').error("I got programming: $services.security.authorization.hasAccess('programming')") #end ``` Back to your profile, click `Test this skin`. Force a refresh, just in case. If the error "Skin - I got programming: true" gets logged, the installation is vulnerable. ### Patches This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1. ### Workarounds We're not aware of any workaround except upgrading. ### References * https://jira.xwiki.org/browse/XWIKI-21478 * https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39 (>= 15.8 RC1) * https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56 (< 15.8 RC1)
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-31987/cnnvd
- https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39cnnvd
- https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2cnnvd
- https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56cnnvd
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cv55-v6rw-7r5vcnnvd
- https://jira.xwiki.org/browse/XWIKI-21478cnnvd
- https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39enisa_euvd
- https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan