CVE-2024-37899 Disabling a user account changes its author, allowing RCE from user account in XWiki

🗓️ 20 Jun 2024 22:13:59Reported by GoogleType

osv🔗 osv.dev👁 15 Views

XWiki Platform admin can execute user's profile with admin rights when disabling user account, allowing for insertion of malicious code. Patched in XWiki 14.10.21, 15.5.5, 15.10.6, 16.0.0. Upgrade advised

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the XWiki platform, which is related to incorrect privilege assignment, allows a perpetrator to execute arbitrary code.	24 Jun 202400:00	–	bdu_fstec
CNNVD	XWiki Platform Code Injection Vulnerability	20 Jun 202400:00	–	cnnvd
CVE	CVE-2024-37899	20 Jun 202422:13	–	cve
Cvelist	CVE-2024-37899 Disabling a user account changes its author, allowing RCE from user account in XWiki	20 Jun 202422:13	–	cvelist
Github Security Blog	XWiki Platform allows remote code execution from user account	20 Jun 202416:19	–	github
NVD	CVE-2024-37899	20 Jun 202423:15	–	nvd
OpenVAS	XWiki 13.4.7 < 14.10.21, 15.0-rc-1 < 15.5.5, 15.6-rc-1 < 15.10.6, 16.0.0-rc-1 < 16.0.0 RCE Vulnerability (GHSA-j584-j2vj-3f93)	25 Jun 202400:00	–	openvas
OSV	GHSA-J584-J2VJ-3F93 XWiki Platform allows remote code execution from user account	20 Jun 202416:19	–	osv
RedhatCVE	CVE-2024-37899	23 May 202509:28	–	redhatcve
Vulnrichment	CVE-2024-37899 Disabling a user account changes its author, allowing RCE from user account in XWiki	20 Jun 202422:13	–	vulnrichment

Source	Link
jira	www.jira.xwiki.org/browse/XWIKI-21611
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37899.json
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-j584-j2vj-3f93
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-37899
github	www.github.com/xwiki/xwiki-platform/commit/f89c8f47fad6e5cc7e68c69a7e0acde07f5eed5a

10 Apr 2026 05:14Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.19

EPSS0.14126