{"id":"CVE-2024-31985","summary":"XWiki Platform CSRF in the job scheduler","details":"XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, manually apply the patch by modifying the `Scheduler.WebHome` page.","aliases":["GHSA-j2r6-r929-v6gf"],"modified":"2026-08-12T15:15:12.889675Z","published":"2024-04-10T20:11:53.091Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31985.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20851"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31985.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2r6-r929-v6gf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31985"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"c62740b018828e1dec52107f480f4cda14776528"},{"fixed":"4810ba1812450ef533c882c5abff598676b1be18"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"5596ee59ff8035c3141aaeddc6e66f119c30574a"},{"introduced":"1e0e26611ad39442be884e876d902441a51fd34a"},{"fixed":"943b4a6a0a0e2b9b94f6f184e823f82b262ea8d3"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.1.1"},{"fixed":"14.10.19"},{"introduced":"15.0"},{"fixed":"15.5.4"},{"introduced":"15.6"},{"fixed":"15.9"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"cf0f4b3c7bd3485b33392dcd986e39f457356de6"},{"fixed":"9d9df1a75094bc677015c7f8321a7e2081662aae"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"0e37972524b5a68c44734112f38a48e746b0909e"},{"introduced":"cb249a1a7570161ad6672449fbe89485fb489e95"},{"fixed":"7a8f9b1236bc9271b607fb92e700377e37f67cf2"},{"fixed":"8a92cb4bef7e5f244ae81eed3e64fe9be95827cf"},{"fixed":"efd3570f3e5e944ec0ad0899bf799bf9563aef87"},{"fixed":"f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c"},{"fixed":"f30d9c641750a3f034b5910c6a3a7724ae8f2269"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.1.1"},{"fixed":"14.10.19"},{"introduced":"15.0"},{"fixed":"15.5.4"},{"introduced":"15.6"},{"fixed":"15.9"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31985.json","vanir_signatures_modified":"2026-08-12T15:15:12Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java"},"deprecated":false,"digest":{"line_hashes":["121378514480918854916168266058246033566","200525902641438542534972148193428897770","185478702196393369682215718148634048340","33822468072397001711675659228385163512","165914234478105040263359577784519239113","160493883172480499829469175096185246806","257095334189023559688806329180752486328","323790012675282877244684223203130316944","210077849249706137297839360767059304759","66062187643554447548786855383546340143"],"threshold":0.9},"id":"CVE-2024-31985-1d303275"},{"digest":{"line_hashes":["121378514480918854916168266058246033566","200525902641438542534972148193428897770","185478702196393369682215718148634048340","33822468072397001711675659228385163512","165914234478105040263359577784519239113","160493883172480499829469175096185246806","257095334189023559688806329180752486328","323790012675282877244684223203130316944","210077849249706137297839360767059304759","66062187643554447548786855383546340143"],"threshold":0.9},"id":"CVE-2024-31985-38a0fb89","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["121378514480918854916168266058246033566","200525902641438542534972148193428897770","185478702196393369682215718148634048340","33822468072397001711675659228385163512","165914234478105040263359577784519239113","160493883172480499829469175096185246806","257095334189023559688806329180752486328","323790012675282877244684223203130316944","210077849249706137297839360767059304759","66062187643554447548786855383546340143"]},"id":"CVE-2024-31985-798c259a","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"239516309326033634555325291864226371297","length":1712},"id":"CVE-2024-31985-89e5dae0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87","target":{"function":"verifyScheduler","file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java"}},{"id":"CVE-2024-31985-b0d52050","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c","target":{"function":"verifyScheduler","file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java"},"deprecated":false,"digest":{"function_hash":"239516309326033634555325291864226371297","length":1712}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["121378514480918854916168266058246033566","200525902641438542534972148193428897770","185478702196393369682215718148634048340","33822468072397001711675659228385163512","165914234478105040263359577784519239113","160493883172480499829469175096185246806","257095334189023559688806329180752486328","323790012675282877244684223203130316944","210077849249706137297839360767059304759","66062187643554447548786855383546340143"]},"id":"CVE-2024-31985-bd9765e2","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java"}},{"deprecated":false,"digest":{"function_hash":"239516309326033634555325291864226371297","length":1712},"id":"CVE-2024-31985-e0f63b75","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java","function":"verifyScheduler"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java","function":"verifyScheduler"},"deprecated":false,"digest":{"function_hash":"239516309326033634555325291864226371297","length":1712},"id":"CVE-2024-31985-e979075f","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"}]}