CVE-2024-31986

Summary

CVE-2024-31986 is a vulnerability affecting the XWiki Platform, a popular wiki solution. Version 3.1 and earlier, up to 4.10.19, 15.5.4, and 15.10-rc-1 are vulnerable. By creating a specially crafted document with an `XWiki.SchedulerJobClass` XObject, attackers can execute arbitrary code on the server. This occurs when an admin visits the scheduler page or when the page is referenced, such as through an image in a comment. Affected users should upgrade to XWiki 14.10.19, 15.5.5, or 15.9 to mitigate the risk. As a temporary fix, users can apply the patch manually by modifying the `Scheduler.WebHome` page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.