CVE-2024-31996
Description
XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool that is used in XWiki doesn't escape {, which, when used in certain places, allows XWiki syntax injection and thereby remote code execution. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9 RC1. Apart from upgrading, there is no generic workaround. However, replacing $escapetool.html by $escapetool.xml in XWiki documents fixes the vulnerability. In a standard XWiki installation, the maintainers are only aware of the document Panels.PanelLayoutUpdate that exposes this vulnerability, patching this document is thus a workaround. Any extension could expose this vulnerability and might thus require patching, too.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.xwiki.commons:xwiki-commons-velocityMaven | >= 3.0.1, < 14.10.19 | 14.10.19 |
org.xwiki.commons:xwiki-commons-velocityMaven | >= 15.0-rc-1, < 15.5.4 | 15.5.4 |
org.xwiki.commons:xwiki-commons-velocityMaven | >= 15.6-rc-1, < 15.9-rc-1 | 15.9-rc-1 |
Affected products
3- Range: >= 3.0.1, < 14.10.19
Patches
Vulnerability mechanics
References
8- github.com/xwiki/xwiki-commons/commit/b0805160ec7b01ee12417e79cb384e60ae4817aanvdPatchWEB
- github.com/xwiki/xwiki-commons/commit/b94142e2a66ec32e89eacab67c3da8d91f5ef93anvdPatchWEB
- github.com/xwiki/xwiki-commons/commit/ed7ff515a2436a1c6dcbd0c6ca0c41e434d58915nvdPatchWEB
- jira.xwiki.org/browse/XCOMMONS-2828nvdExploitVendor AdvisoryWEB
- jira.xwiki.org/browse/XWIKI-21438nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-hf43-47q4-fhq5ghsaADVISORY
- github.com/xwiki/xwiki-commons/security/advisories/GHSA-hf43-47q4-fhq5nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-31996ghsaADVISORY
News mentions
0No linked articles in our index yet.