5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
6.8 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.3%
It is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image.
To reproduce in an XWiki installation, open <xwiki-host>:/xwiki/bin/view/Scheduler/?do=trigger&which=Scheduler.NotificationEmailDailySender
as a user with admin rights. If there is no error message that indicates the CSRF token is invalid, the installation is vulnerable.
The vulnerability has been fixed on XWiki 14.10.19, 15.5.5, and 15.9.
Modify the Scheduler.WebHome page following this patch.
github.com/xwiki/xwiki-platform
github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf
github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87
github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c
github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269
github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2r6-r929-v6gf
jira.xwiki.org/browse/XWIKI-20851
nvd.nist.gov/vuln/detail/CVE-2024-31985
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
6.8 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.3%