Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-31985 Details

Description

XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, manually apply the patch by modifying the `Scheduler.WebHome` page.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CNA: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf	CVE	Patch
https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87	CVE	Patch
https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c	CVE	Patch
https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269	CVE	Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2r6-r929-v6gf	CVE	Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20851	CVE	ExploitVendor Advisory
https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf	[email protected]	Patch
https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87	[email protected]	Patch
https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c	[email protected]	Patch
https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269	[email protected]	Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2r6-r929-v6gf	[email protected]	Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20851	[email protected]	ExploitVendor Advisory

see all 12 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-352	Cross-Site Request Forgery (CSRF)	[email protected]
CWE-352	Cross-Site Request Forgery (CSRF)	[email protected]

Affected Products

Product	Versions
xwiki xwiki	>= 3.1.1, < 14.10.19 >= 15.0, < 15.5.4 >= 15.6, < 15.9
CPE cpe:2.3:a:xwiki:xwiki:::::::: Remediation No remediation found in references.

Change History

6 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Jan 23, 2025	Initial Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Apr 10, 2024	New CVE Received	[email protected]