{"id":"CVE-2024-31986","summary":"XWiki Platform CSRF remote code execution through scheduler job's document reference","details":"XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special crafted documented reference and an `XWiki.SchedulerJobClass` XObject, it is possible to execute arbitrary code on the server whenever an admin visits the scheduler page or the scheduler page is referenced, e.g., via an image in a comment on a page in the wiki. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, apply the patch manually by modifying the `Scheduler.WebHome` page.","aliases":["GHSA-37m4-hqxv-w26g"],"modified":"2026-08-12T15:15:12.635985Z","published":"2024-04-10T20:27:29.600Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31986.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-352","CWE-95"]},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-21416"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31986.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-37m4-hqxv-w26g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31986"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"c62740b018828e1dec52107f480f4cda14776528"},{"fixed":"4810ba1812450ef533c882c5abff598676b1be18"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"5596ee59ff8035c3141aaeddc6e66f119c30574a"},{"introduced":"1e0e26611ad39442be884e876d902441a51fd34a"},{"fixed":"943b4a6a0a0e2b9b94f6f184e823f82b262ea8d3"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.1.1"},{"fixed":"14.10.19"},{"introduced":"15.0"},{"fixed":"15.5.4"},{"introduced":"15.6"},{"fixed":"15.9"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"cf0f4b3c7bd3485b33392dcd986e39f457356de6"},{"fixed":"9d9df1a75094bc677015c7f8321a7e2081662aae"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"0e37972524b5a68c44734112f38a48e746b0909e"},{"introduced":"cb249a1a7570161ad6672449fbe89485fb489e95"},{"fixed":"7a8f9b1236bc9271b607fb92e700377e37f67cf2"},{"fixed":"8a92cb4bef7e5f244ae81eed3e64fe9be95827cf"},{"fixed":"efd3570f3e5e944ec0ad0899bf799bf9563aef87"},{"fixed":"f30d9c641750a3f034b5910c6a3a7724ae8f2269"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.1.1"},{"fixed":"14.10.19"},{"introduced":"15.0"},{"fixed":"15.5.4"},{"introduced":"15.6"},{"fixed":"15.9"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31986.json","vanir_signatures_modified":"2026-08-12T15:15:12Z","vanir_signatures":[{"target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java"},"deprecated":false,"digest":{"line_hashes":["121378514480918854916168266058246033566","200525902641438542534972148193428897770","185478702196393369682215718148634048340","33822468072397001711675659228385163512","165914234478105040263359577784519239113","160493883172480499829469175096185246806","257095334189023559688806329180752486328","323790012675282877244684223203130316944","210077849249706137297839360767059304759","66062187643554447548786855383546340143"],"threshold":0.9},"id":"CVE-2024-31986-1d303275","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269"},{"source":"https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java"},"deprecated":false,"digest":{"line_hashes":["121378514480918854916168266058246033566","200525902641438542534972148193428897770","185478702196393369682215718148634048340","33822468072397001711675659228385163512","165914234478105040263359577784519239113","160493883172480499829469175096185246806","257095334189023559688806329180752486328","323790012675282877244684223203130316944","210077849249706137297839360767059304759","66062187643554447548786855383546340143"],"threshold":0.9},"id":"CVE-2024-31986-38a0fb89","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"239516309326033634555325291864226371297","length":1712},"id":"CVE-2024-31986-89e5dae0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java","function":"verifyScheduler"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["121378514480918854916168266058246033566","200525902641438542534972148193428897770","185478702196393369682215718148634048340","33822468072397001711675659228385163512","165914234478105040263359577784519239113","160493883172480499829469175096185246806","257095334189023559688806329180752486328","323790012675282877244684223203130316944","210077849249706137297839360767059304759","66062187643554447548786855383546340143"],"threshold":0.9},"id":"CVE-2024-31986-bd9765e2","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java"}},{"digest":{"function_hash":"239516309326033634555325291864226371297","length":1712},"id":"CVE-2024-31986-e0f63b75","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java","function":"verifyScheduler"},"deprecated":false},{"source":"https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-test/xwiki-platform-scheduler-test-docker/src/test/it/org/xwiki/scheduler/test/ui/SchedulerIT.java","function":"verifyScheduler"},"deprecated":false,"digest":{"function_hash":"239516309326033634555325291864226371297","length":1712},"id":"CVE-2024-31986-e979075f","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}