CVE-2024-31985 json
XWiki Platform CSRF in the job scheduler
published 2024-04-10 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1223 , GHSA-j2r6-r929-v6gf
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, manually apply the patch by modifying the `Scheduler.WebHome` page.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-scheduler-ui 14.10.19, 15.5.4, 15.9
- org.xwiki.platform xwiki-platform-scheduler-ui 14.10.19, 15.5.4, 15.9
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-20851 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-scheduler-ui | >=3.1, <14.10.19 >=15.0-rc-1, <15.5.4 >=15.6-rc-1, <15.9 |
14.10.19 15.5.4 15.9 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf
web, patch
-
github.com
/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87
web, patch
-
github.com
/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c
web, patch
-
github.com
/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269
web, patch
-
jira.xwiki.org
/browse/XWIKI-20851
web, exploit, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-j2r6-r929-v6gf
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-31985
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2024-31985
- GitHub Advisory GHSA-j2r6-r929-v6gf
- NVD CVE-2024-31985
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.