CVE-2024-31465: Improper Neutralization of Directives in Dynamically Evaluated Code

🗓️ 10 Apr 2024 00:00:00Reported by Rapid7Type

XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type XWiki.SearchSuggestS...

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the XWiki.SearchSuggestSourceClass class in the XWiki platform, a collaborative web application platform. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.	24 Feb 202500:00	–	bdu_fstec
CNNVD	XWiki Platform 安全漏洞	10 Apr 202400:00	–	cnnvd
CVE	CVE-2024-31465	10 Apr 202419:12	–	cve
Cvelist	CVE-2024-31465 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet	10 Apr 202419:12	–	cvelist
Github Security Blog	XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet	10 Apr 202417:11	–	github
NVD	CVE-2024-31465	10 Apr 202420:15	–	nvd
OpenVAS	XWiki 5.2-milestone-2 < 14.10.20, 15.0-rc-1 < 15.5.4, 15.6-rc-1 < 15.10 RCE Vulnerability (GHSA-34fj-r5gq-7395)	15 Apr 202400:00	–	openvas
OSV	GHSA-34FJ-R5GQ-7395 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet	10 Apr 202417:11	–	osv
Positive Technologies	PT-2024-24096 · Xwiki · Xwiki Platform	26 Oct 202300:00	–	ptsecurity
RedhatCVE	CVE-2024-31465	23 May 202507:40	–	redhatcve