CVE-2024-31982

🗓️ 10 Apr 2024 19:38:01Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 191 Views🌐 WEB

XWiki Platform version 2.4-milestone-1 before 4.10.20, 15.5.4, and 15.10-rc-1 allows remote code execution via database search text, impacting confidentiality, integrity, and availability. Patched in XWiki 14.10.20, 15.5.4, and 15.10RC1

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for Code Injection in Xwiki	22 Jun 202408:47	–	githubexploit
GithubExploit	Exploit for Code Injection in Xwiki	22 Jun 202417:04	–	githubexploit
GithubExploit	Exploit for Code Injection in Xwiki	22 Jun 202421:20	–	githubexploit
Information Security Automation	New episode “In The Trend of VM” (#9): 4 trending vulnerabilities of October, scandal at The Linux Foundation, social “attack on the complainer”, “Ford’s method” for motivating IT specialists to fix vulnerabilities	28 Nov 202412:57	–	avleonov
Information Security Automation	About Remote Code Execution – XWiki Platform (CVE-2024-31982) vulnerability	31 Oct 202411:50	–	avleonov
BDU FSTEC	The vulnerability of the DatabaseSearch function in the XWiki platform, a tool for creating collaborative web applications. This vulnerability allows attackers to execute arbitrary code.	1 Nov 202400:00	–	bdu_fstec
Circl	CVE-2024-31982	22 Jun 202421:25	–	circl
CNNVD	XWiki Platform 安全漏洞	10 Apr 202400:00	–	cnnvd
Cvelist	CVE-2024-31982 XWiki Platform: Remote code execution as guest via DatabaseSearch	10 Apr 202419:38	–	cvelist
Github Security Blog	XWiki Platform: Remote code execution as guest via DatabaseSearch	10 Apr 202417:12	–	github

NVD

Vulners

Vulnrichment

Node

xwiki xwikiRange2.4–14.10.20

xwiki xwikiRange15.0–15.5.4

xwiki xwikiRange15.6–15.10

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 2.4-milestone-1, < 14.10.20",
        "status": "affected"
      },
      {
        "version": ">= 15.0-rc-1, < 15.5.4",
        "status": "affected"
      },
      {
        "version": ">= 15.6-rc-1, < 15.10-rc-1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vicarius	www.vicarius.io/vsociety/posts/xwiki-rce-cve-2024-31982
github	www.github.com/xwiki/xwiki-platform/commit/459e968be8740c8abc2a168196ce21e5ba93cfb8
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-2858-8cfx-69m9
github	www.github.com/xwiki/xwiki-platform/commit/3c9e4bb04286de94ad24854026a09fa967538e31
jira	www.jira.xwiki.org/browse/XWIKI-21472
github	www.github.com/xwiki/xwiki-platform/commit/95bdd6cc6298acdf7f8f21298d40eeb8390a8565
vicarius	www.vicarius.io/vsociety/posts/cve-2024-31982-detect-xwiki-vulnerability
vicarius	www.vicarius.io/vsociety/posts/cve-2024-31982-xwiki-mitigation-vulnerability

Parameter	Position	Path	Description	CWE
searchText	path	Main.DatabaseSearch	Remote code execution via database search in XWiki Platform prior to patch versions.	CWE-95, CWE-94

17 Jun 2026 07:29Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8 - 10

EPSS0.3428

SSVC