Description

XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, manually apply the patch by modifying the `Scheduler.WebHome` page.

Remediation

References

CVE-2024-31985

Related Vulnerabilities

Drupal CVE-2020-28949 Vulnerability (CVE-2020-28949)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-3997)

Magento Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-8151)

Apache Tomcat Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-3386)

WordPress Plugin NextGEN Gallery-WordPress Gallery 'swfupload.swf' Cross-Site Scripting (1.9.7)

Severity

Medium

Classification

CVE-2024-31985 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Tags

Missing Update Known Vulnerabilities