This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] XWiki fixes 12 vulnerabilities, 10 of them critical
XWiki fixes 12 vulnerabilities, 10 of which are critical, in versions 14.10.20, 15.5.4 and 15.10-rc-1. A procedure for verifying whether your instance is vulnerable can be found in the link next to each vulnerability.
An unauthenticated remote attacker can interfere with the task scheduler without authorization. Exploiting the vulnerability requires admin interaction [1].
The vulnerability is present in product:
- Xwiki; >= 3.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
More information:
- CVE-2024-31985 at cve.org, NVD
- CWE-352 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An authenticated remote attacker with rights to edit the space title can execute arbitrary Groovy code without authorization, which would lead to compromise of the entire instance [2].
The vulnerability is present in product:
- XWiki; >= 7.2-rc-1, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31984 at cve.org, NVD
- CWE-95 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An authenticated remote attacker with edit rights can execute arbitrary Groovy code without authorization, which would lead to compromise of the entire instance [3].
The vulnerability is present in product:
- XWiki; >= 4.3-milestone-2, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31983 at cve.org, NVD
- CWE-862 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An unauthenticated remote attacker can execute arbitrary Groovy code without authorization, which would lead to compromise of the entire instance [4].
The vulnerability is present in product:
- XWiki; >= 2.4-milestone-1, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31982 at cve.org, NVD
- CWE-95 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An authenticated remote attacker can obtain programming rights [5].
The vulnerability is present in product:
- XWiki; >= 3.0.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31981 at cve.org, NVD
- CWE-862 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An authenticated remote attacker with edit rights on any page can execute arbitrary Groovy code without authorization, which would lead to compromise of the entire instance [6].
The vulnerability is present in product:
- XWiki; >= 5.2-milestone-2, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31465 at cve.org, NVD
- CWE-95 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An authenticated remote attacker with rights to edit user pages can, under certain circumstances, view the password hashes of those users [7].
The vulnerability is present in product:
- XWiki; >= 5.0-rc-1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2024-31464 at cve.org, NVD
- CWE-200 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An authenticated remote attacker with edit rights on any document can execute arbitrary code without authorization, which would lead to compromise of the entire instance [8].
The vulnerability is present in product:
- XWiki; < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31997 at cve.org, NVD
- CWE-862 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An unauthenticated remote attacker can execute arbitrary code without authorization, which would lead to compromise of the entire instance [9].
The vulnerability is present in product:
- XWiki; >= 3.0.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31996 at cve.org, NVD
- CWE-95 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An unauthenticated remote attacker can execute arbitrary Groovy/Python code without authorization, which would lead to compromise of the entire instance. Exploiting the vulnerability requires the real-time editor to be installed in XWiki as well as administrator interaction [10].
The vulnerability is present in product:
- XWiki; >= 13.9-rc-1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31988 at cve.org, NVD
- CWE-352 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An authenticated remote attacker with edit rights on any page can execute arbitrary code, which would lead to compromise of the entire instance [11].
The vulnerability is present in product:
- XWiki; >= 6.4-milestone-1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31987 at cve.org, NVD
- CWE-862 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
An authenticated remote attacker can execute arbitrary code by creating a document with specially crafted references. Exploiting the vulnerability requires administrator interaction [12].
The vulnerability is present in product:
- XWiki; >= 3.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
More information:
- CVE-2024-31986 at cve.org, NVD
- CWE-95 at cwe.mitre.org
The vulnerability was publicly disclosed 10. 4. 2024.
Links
- [1] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2r6-r929-v6gf
- [2] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xm4h-3jxr-m3c6
- [3] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xxp2-9c9g-7wmj
- [4] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2858-8cfx-69m9
- [5] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxwr-wpjv-qjq7
- [6] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-34fj-r5gq-7395
- [7] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v782-xr4w-3vqx
- [8] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c2gg-4gq4-jv5j
- [9] https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-hf43-47q4-fhq5
- [10] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r5vh-gc3r-r24w
- [11] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cv55-v6rw-7r5v
- [12] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-37m4-hqxv-w26g
By CESNET, z.s.p.o. Martin Krajči on 11. 4. 2024.