CVE-2024-31985
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Summary
CVE-2024-31985 is a vulnerability in XWiki Platform, a generic wiki platform. Versions 3.1 and prior to 4.10.20, 15.5.4, and 15.10-rc-1 are affected. The vulnerability allows an admin to schedule/trigger/unschedule existing jobs by visiting the Job Scheduler page through a predictable URL, which can be embedded in any content as an image. The issue has been resolved in XWiki versions 14.10.19, 15.5.5, and 15.9. As a workaround, the patch can be manually applied by modifying the `Scheduler.WebHome` page. The vulnerability has a base severity of MEDIUM with low integrity impact and no confidentiality impact, requiring user interaction over a network for exploitation. Note: The provided information is limited and additional details may be required for a comprehensive understanding of the vulnerability and its potential impact on organizations using XWiki Platform.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions