CVE-2024-31982

CVE-2024-31982 Java SSTI - RCE につながる root@kitploit: async async=falsegroovyprintln"Successful Injection"/groovy/ root@kitploit: GET...

The vulnerability of the DatabaseSearch function in the XWiki platform, a tool for creating collaborative web applications. This vulnerability allows attackers to execute arbitrary code.

The vulnerability of the DatabaseSearch function in the XWiki platform for creating collaborative web applications stems from the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remote...

CVE-2024-31982 XWiki Platform: Remote code execution as guest via DatabaseSearch

XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a close...

CVE-2024-31982 XWiki Platform: Remote code execution as guest via DatabaseSearch

XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a close...

XWiki Platform: Remote code execution as guest via DatabaseSearch

Impact XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and...