CVE-2024-31981
CVSS v3.1
9.9 (Critical)
EPSS
0.04 % (16th)
Advisories
1
XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, remote code execution is possible via PDF export templates. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10-rc-1. If PDF templates are not typically used on the instance, an administrator can create the document XWiki.PDFClass
and block its edition, after making sure that it does not contain a style
attribute. Otherwise, there are no known workarounds aside from upgrading.
Weaknesses
- CWE-862
- Missing Authorization
- CVE Status
- PUBLISHED
- CNA
- GitHub, Inc.
- Published Date
-
2024-04-10 20:15:08
(5 months ago) - Updated Date
-
2024-04-11 12:47:44
(5 months ago)
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...