{"id":"CVE-2024-31987","summary":"XWiki Platform remote code execution from account via custom skins support","details":"XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution. This has been patched in XWiki 14.10.19, 15.5.4 and 15.10RC1. No known workarounds are available except for upgrading.","aliases":["GHSA-cv55-v6rw-7r5v"],"modified":"2026-08-12T15:15:13.388529Z","published":"2024-04-10T20:32:39.317Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31987.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-21478"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31987.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cv55-v6rw-7r5v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31987"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"9b5854ea3b9092d77d7155bf72cc32192af204f1"},{"fixed":"4810ba1812450ef533c882c5abff598676b1be18"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"5596ee59ff8035c3141aaeddc6e66f119c30574a"},{"introduced":"1e0e26611ad39442be884e876d902441a51fd34a"},{"fixed":"a21846242821db564378bb68b1060fa42c632d16"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"6.4"},{"fixed":"14.10.19"},{"introduced":"15.0"},{"fixed":"15.5.4"},{"introduced":"15.6"},{"fixed":"15.10"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"4b136af703f2f0d8f0f7e7847ededd976caa0944"},{"fixed":"9d9df1a75094bc677015c7f8321a7e2081662aae"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"0e37972524b5a68c44734112f38a48e746b0909e"},{"introduced":"cb249a1a7570161ad6672449fbe89485fb489e95"},{"fixed":"4605ed423dbd0f2bcbd4d1c5d11f52f4b1861f34"},{"fixed":"3d4dbb41f52d1a6e39835cfb1695ca6668605a39"},{"fixed":"626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2"},{"fixed":"da177c3c972e797d92c1a31e278f946012c41b56"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"6.4"},{"fixed":"14.10.19"},{"introduced":"15.0"},{"fixed":"15.5.4"},{"introduced":"15.6"},{"fixed":"15.10"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/render/DefaultVelocityManagerTest.java"},"deprecated":false,"digest":{"line_hashes":["137853416719674353210414497559944909550","29166595586466143103290196561440396701","27962313427399586723936632709943560085","256602814203605410997848562226010996092","20891093493143598683422580089758695620","246948114122229911501923503621690942778","257800635591331744963526281334040823813","232721121624111824347346902109381141409","283902169196506932145782277596687939963","43350383026324345258909145540658872837","288481945063506707654037642543444402335","19359971952024800086096917848019133123","38555795804391231521577314644363903348","248858750669232818607523658186131547694","256043208940901677539325613281629194094","275129746972808441404563126035076464653","291343476049516903506262767240809956031","29112383532272486362096947541614266282","46670543324398585527025919486585779178","206879769686165570987372372110071845213","233125043463828079831024165736977871827","83665135677302594411080651264654605882","59110861701862327351111331854595026310","242817595383101308654778698879593696536","250690583252921574947386381536366755858","156947290257827847506102438162283668751","48600620016886288935767489940222850873","212194744068313242852282593223118373242","183678169844810441324270296001642602863","234775404429131672491972892041251701540","328931988403073289216047863200579885308","170829821206102114707666228136867378007","182150473780783403154450371122631960618","20482770512612178433846187280203976728","299734484642803094469214152485819484676","194817626647339646289695144400547956918","285864611570211588971109270161430802174","147988173249519946810905120890342298814","198910306559555278211298200516159393430","42760891683971998287500769432715366986","115530886466485088881368146656473384501","167812098765061358105392079751263162680","326901514594706765838770395612453711691","200018349619111549302700167258585310659","237768029738789413331296782650036114808","101166768989053146758293026463071802175","145965635385160748808947245500740468380","55966831038664951465217684911425052219","247594967892303130582032956717670850205","308428030406836490943042034541208962590","323848967580160165588074489465599972641","127939232685986239390258508648685365507","108233995559823381944880056704543602398","160363620122574886795292745732104991569","295031596098470114845769359430997257509","185035514504899756877064709211743844978"],"threshold":0.9},"id":"CVE-2024-31987-10b8f3d7"},{"deprecated":false,"digest":{"function_hash":"262623925310122088733525421671336960898","length":208},"id":"CVE-2024-31987-3b1f305d","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/render/DefaultVelocityManagerTest.java","function":"before"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/velocity/XWikiVelocityManager.java"},"deprecated":false,"digest":{"line_hashes":["121174310181390275505445698797136895927","34277736140161489015399361147067544819","62272166128129828382412913215595601786","196587760379148431648075823904787700796","91853146859998432910540865310362986967","261424991849316478252519792546739575338","173522166365887956399539705725348815325","202926890028522163323965623485987388910","270950634505058574568372137923300237742","267181163087622272183991553613107421354","226234234689986636015272235405739996359","219092182023209890479233969766072077076","194796617679597203510197970585330548183","34828799062158409010146374856063607623","111560819602575128186820906339342542748","6266893581983332832947165293665400346","163158097088658351790255152068046505298","173245891586540734638410780692483388793","155386555607749928410348859563366146886","216768724898797790209777897586225504724","55082930528018415316176065733635317906","287184087156972020729609464502334183414","316299248106577100104346869917591732288","16039172261634809689032683717431004334","315191601900379609454448759297063845659","78159838874145134555454881515346451130"],"threshold":0.9},"id":"CVE-2024-31987-547d130b","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39"},{"source":"https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/render/DefaultVelocityManager.java","function":"getVelocityEngine"},"deprecated":false,"digest":{"function_hash":"26108116625947527575579528426580159908","length":948},"id":"CVE-2024-31987-6340940f","signature_type":"Function","signature_version":"v1"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/render/DefaultVelocityManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146189731071989536956798340880196739902","310739239447028098765105671234380534316","52009712935517825132501529274369789293","261157546600156828182316179212332491513","91853146859998432910540865310362986967","261424991849316478252519792546739575338","316663541752993777931184136781387515778","114981041546970049580100935714772728675","299777750658626943246928267322202800439","159825362872999615020258580671290465893","193290101297679604748099444679964533397","199399517114900949874998702069195480429","85819947157801412237260019660837452295","103298764609852117631469825659443142617","93133123945916339308890628700092340460","257198679223990047655778131818938498740","33784898049962599526334342451421762483","94290706179367357699112962178868440750","174017238389561423526619868877073546889","36185742351135053116766244355600114844","276897831259542004261052799457512799280","108587633537507210242609878158511307392"]},"id":"CVE-2024-31987-6d2b0314","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/velocity/XWikiVelocityManager.java","function":"initialize"},"deprecated":false,"digest":{"function_hash":"327394700977745032445853822043186284772","length":530},"id":"CVE-2024-31987-6fccefba","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39"},{"id":"CVE-2024-31987-7c603acb","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/velocity/XWikiVelocityManager.java","function":"injectBaseMacros"},"deprecated":false,"digest":{"function_hash":"91915450805051259588401646404838816441","length":468}},{"source":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/org/xwiki/internal/velocity/XWikiVelocityManagerTest.java","function":"beforeEach"},"deprecated":false,"digest":{"function_hash":"220906803712991933718914799329010703331","length":178},"id":"CVE-2024-31987-7ebf93eb","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["146189731071989536956798340880196739902","310739239447028098765105671234380534316","52009712935517825132501529274369789293","261157546600156828182316179212332491513","91853146859998432910540865310362986967","261424991849316478252519792546739575338","316663541752993777931184136781387515778","114981041546970049580100935714772728675","299777750658626943246928267322202800439","159825362872999615020258580671290465893","193290101297679604748099444679964533397","199399517114900949874998702069195480429","85819947157801412237260019660837452295","103298764609852117631469825659443142617","93133123945916339308890628700092340460","257198679223990047655778131818938498740","33784898049962599526334342451421762483","94290706179367357699112962178868440750","174017238389561423526619868877073546889","36185742351135053116766244355600114844","276897831259542004261052799457512799280","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2024-31987-80d9641c","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/render/DefaultVelocityManager.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/render/DefaultVelocityManagerTest.java"},"deprecated":false,"digest":{"line_hashes":["137853416719674353210414497559944909550","29166595586466143103290196561440396701","27962313427399586723936632709943560085","256602814203605410997848562226010996092","20891093493143598683422580089758695620","246948114122229911501923503621690942778","257800635591331744963526281334040823813","232721121624111824347346902109381141409","283902169196506932145782277596687939963","43350383026324345258909145540658872837","288481945063506707654037642543444402335","19359971952024800086096917848019133123","38555795804391231521577314644363903348","248858750669232818607523658186131547694","256043208940901677539325613281629194094","275129746972808441404563126035076464653","291343476049516903506262767240809956031","29112383532272486362096947541614266282","46670543324398585527025919486585779178","206879769686165570987372372110071845213","233125043463828079831024165736977871827","83665135677302594411080651264654605882","59110861701862327351111331854595026310","242817595383101308654778698879593696536","250690583252921574947386381536366755858","156947290257827847506102438162283668751","48600620016886288935767489940222850873","212194744068313242852282593223118373242","183678169844810441324270296001642602863","234775404429131672491972892041251701540","328931988403073289216047863200579885308","170829821206102114707666228136867378007","182150473780783403154450371122631960618","20482770512612178433846187280203976728","299734484642803094469214152485819484676","194817626647339646289695144400547956918","285864611570211588971109270161430802174","147988173249519946810905120890342298814","198910306559555278211298200516159393430","42760891683971998287500769432715366986","115530886466485088881368146656473384501","167812098765061358105392079751263162680","326901514594706765838770395612453711691","200018349619111549302700167258585310659","237768029738789413331296782650036114808","101166768989053146758293026463071802175","145965635385160748808947245500740468380","55966831038664951465217684911425052219","247594967892303130582032956717670850205","308428030406836490943042034541208962590","323848967580160165588074489465599972641","127939232685986239390258508648685365507","108233995559823381944880056704543602398","160363620122574886795292745732104991569","295031596098470114845769359430997257509","185035514504899756877064709211743844978"],"threshold":0.9},"id":"CVE-2024-31987-8223f435"},{"deprecated":false,"digest":{"function_hash":"262623925310122088733525421671336960898","length":208},"id":"CVE-2024-31987-a2d93fb3","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/render/DefaultVelocityManagerTest.java","function":"before"}},{"id":"CVE-2024-31987-b7084d9f","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/render/DefaultVelocityManagerTest.java","function":"getVelocityContext"},"deprecated":false,"digest":{"function_hash":"80399419212923564274575179664129964215","length":1247}},{"id":"CVE-2024-31987-c9164c29","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/render/DefaultVelocityManagerTest.java","function":"getVelocityContext"},"deprecated":false,"digest":{"function_hash":"80399419212923564274575179664129964215","length":1247}},{"deprecated":false,"digest":{"line_hashes":["244204443664514302379353346045396909509","51143179591373560558002069869939258760","35830348605083864677855498924980981238","96619712731698817525054917591368906173","225947036606155088485663638667533061275","257800635591331744963526281334040823813","232721121624111824347346902109381141409","299817941020114374398885494075455616141","4374598656514119766248302521054178504","188015816087801542538245535010045008413","92262876795579429971221784277362908695","170602437839320568711890283309732104147","103172412331184963711984210762926767593","61769728434622688402367905560291595490","239155114422200711252066937814210786449","228746186467494796300134036259496604724","258902021815419648168905049119943986929","126961189106326939768508731658499218598","295428602211100344275426352762318624531","29973314293322410879355435113587431352","99488483201572076344386539631828608301","120326394938743270970853795412322795486","266344285713955895037113401803271729649","329804238655890304157981881201785056934","41945847698649912705122026551406330795","28391751838870905994648677565847670415","90193164423074720855122565822627291017","299734484642803094469214152485819484676","25110906057917741044822993109498596203","116890663556713837689722316363327175921","241941714401047188157623370741334063886","239693144727634389549457668295488435941","238662039844827306374112271111427978617","339115459122557519805759473896561012178","295031596098470114845769359430997257509","185035514504899756877064709211743844978"],"threshold":0.9},"id":"CVE-2024-31987-cd7f6951","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/org/xwiki/internal/velocity/XWikiVelocityManagerTest.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/render/DefaultVelocityManager.java","function":"getVelocityEngine"},"deprecated":false,"digest":{"function_hash":"26108116625947527575579528426580159908","length":948},"id":"CVE-2024-31987-d590f5ec"},{"target":{"function":"getVelocityContext","file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/org/xwiki/internal/velocity/XWikiVelocityManagerTest.java"},"deprecated":false,"digest":{"function_hash":"271094490181522773843191380936972454229","length":1184},"id":"CVE-2024-31987-e0f1068b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/velocity/XWikiVelocityManager.java","function":"onEvent"},"deprecated":false,"digest":{"function_hash":"261958817673646506510076999208271329011","length":178},"id":"CVE-2024-31987-e6ea1821","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31987.json","vanir_signatures_modified":"2026-08-12T15:15:13Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}