CVE-2024-31981 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass

🗓️ 10 Apr 2024 19:22:57Reported by GitHub_MType

XWiki Platform Privilege escalation via PDFClas

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the PDFClassHandler component of the XWiki Platform, a platform for creating collaborative web applications. The XWiki Platform allows attackers to enhance their privileges.	9 Apr 202500:00	–	bdu_fstec
CNNVD	XWiki Platform 安全漏洞	10 Apr 202400:00	–	cnnvd
CVE	CVE-2024-31981	10 Apr 202419:22	–	cve
Github Security Blog	XWiki Platform: Privilege escalation (PR) from user registration through PDFClass	10 Apr 202417:11	–	github
NVD	CVE-2024-31981	10 Apr 202420:15	–	nvd
OpenVAS	XWiki 3.0.1 < 14.10.19, 15.0-rc-1 < 15.5.4, 15.6-rc-1 < 15.9 Privilege Escalation Vulnerability (GHSA-vxwr-wpjv-qjq7)	15 Apr 202400:00	–	openvas
OSV	CVE-2024-31981 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass	10 Apr 202419:22	–	osv
OSV	GHSA-VXWR-WPJV-QJQ7 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass	10 Apr 202417:11	–	osv
Positive Technologies	PT-2024-24333 · Xwiki · Xwiki Platform	21 Sep 202300:00	–	ptsecurity
RedhatCVE	CVE-2024-31981	23 May 202510:12	–	redhatcve

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 3.0.1, < 14.10.20",
        "status": "affected"
      },
      {
        "version": ">= 15.0-rc-1, < 15.5.4",
        "status": "affected"
      },
      {
        "version": ">= 15.6-rc-1, < 15.10-rc-1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/xwiki/xwiki-platform/commit/480186f9d2fca880513da8bc5a609674d106cbd3
jira	www.jira.xwiki.org/browse/XWIKI-21337
github	www.github.com/xwiki/xwiki-platform/commit/a4ad14d9c1605a5ab957237e505ebbb29f5b9d73
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxwr-wpjv-qjq7
github	www.github.com/xwiki/xwiki-platform/commit/d28e21a670c69880b951e415dd2ddd69d273eae9

10 Apr 2024 19:22Current

9.9High risk

Vulners AI Score9.9

CVSS 3.19.9

EPSS0.01447

CWE-862