CVE-2024-31982: XWiki Platform: Remote code execution as guest via DatabaseSearch
(updated )
XWiki’s database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation.
References
- github.com/advisories/GHSA-2858-8cfx-69m9
- github.com/xwiki/xwiki-platform
- github.com/xwiki/xwiki-platform/commit/3c9e4bb04286de94ad24854026a09fa967538e31
- github.com/xwiki/xwiki-platform/commit/459e968be8740c8abc2a168196ce21e5ba93cfb8
- github.com/xwiki/xwiki-platform/commit/95bdd6cc6298acdf7f8f21298d40eeb8390a8565
- github.com/xwiki/xwiki-platform/security/advisories/GHSA-2858-8cfx-69m9
- jira.xwiki.org/browse/XWIKI-21472
- nvd.nist.gov/vuln/detail/CVE-2024-31982
- www.vicarius.io/vsociety/posts/cve-2024-31982-detect-xwiki-vulnerability
- www.vicarius.io/vsociety/posts/cve-2024-31982-xwiki-mitigation-vulnerability
- www.vicarius.io/vsociety/posts/xwiki-rce-cve-2024-31982
Code Behaviors & Features
Detect and mitigate CVE-2024-31982 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →