CVE-2024-31465

CVSS 3.1 Score 9.9 of 10 (high)

Details

Published Apr 10, 2024
Updated: Apr 11, 2024
CWE ID 95

Summary

CVE-2024-31465 is a critical vulnerability affecting XWiki Platform versions 5.0-rc-1 and earlier. By adding an object of type XWiki.SearchSuggestSourceClass to their user profile or any other page, any user with edit rights can execute arbitrary code on the server, compromising the confidentiality, integrity, and availability of the entire XWiki installation. This vulnerability has been patched in versions 14.10.20, 15.5.4, and 15.10 RC1. As a temporary workaround, users can manually apply the patch to the document XWiki.SearchSuggestSourceSheet. The exploitability score is 3.1 out of 10, with a base severity rating of critical (9.9 out of 10), low privileges required, no user interaction needed, and network-based attack vector. The impact score is 6.0 out of 10, with high integrity and confidentiality impacts and high availability impact according to the CVSS:3.1 vector string provided by security-advisories@github.com.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-31465 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options