{"id":"CVE-2024-37901","summary":"XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of `XWiki.SearchSuggestConfig` and `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.21, 15.5.5 and 15.10.2.","aliases":["GHSA-h63h-5c77-77p5"],"modified":"2026-08-12T14:52:11.856800Z","published":"2024-07-31T15:19:36.588Z","database_specific":{"cwe_ids":["CWE-862","CWE-95"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37901.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-21473"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37901.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h63h-5c77-77p5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37901"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/0b135760514fef73db748986a3311f3edd4a553b"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/742cd4591642be4cdcaf68325f17540e0934e64e"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/9ce3e0319869b6d8131fc4e0909736f7041566a4"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/bbde8a4f564e3c28839440076334a9093e2b4834"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"d3fc0294e580efb11955ec929cc0d53b750b4f2a"},{"fixed":"c6cc6af0637c7e8f8be850fe4af66576934f8a53"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"5583e277218ab5de9930d969082a19ed0db4e472"},{"introduced":"1e0e26611ad39442be884e876d902441a51fd34a"},{"fixed":"fef33dfb4bd9ebdf1aa8867cadecf08a816457e4"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.2"},{"fixed":"14.10.21"},{"introduced":"15.0"},{"fixed":"15.5.5"},{"introduced":"15.6"},{"fixed":"15.10.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"db07f6419d5958ca415f9a43c61c09e1202e0867"},{"fixed":"1bcc6e962dc5701ae6f9745a209a5c0c97461128"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"447f13c6b159cf0671b65c6be8f790cf046d7ada"},{"introduced":"cb249a1a7570161ad6672449fbe89485fb489e95"},{"fixed":"c836beb16fd76f506a9432a4caef3f347f2a5af3"},{"fixed":"0b135760514fef73db748986a3311f3edd4a553b"},{"fixed":"742cd4591642be4cdcaf68325f17540e0934e64e"},{"fixed":"9ce3e0319869b6d8131fc4e0909736f7041566a4"},{"fixed":"bbde8a4f564e3c28839440076334a9093e2b4834"}],"database_specific":{"extracted_events":[{"introduced":"9.2"},{"fixed":"14.10.21"},{"introduced":"15.0"},{"fixed":"15.5.5"},{"introduced":"15.6"},{"fixed":"15.10.2"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37901.json","vanir_signatures_modified":"2026-08-12T14:52:11Z","vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["181206592806760174228566008667523864015","176669811463110203208316978837459847221","265457976098476163797035710965108330724","66027141029162381916987723313395333349","113460953889839962246598583683241058433","167863152323126058797535713195961477121","204078277445743465588132534169897462226","70660062906184790187707202900276158444","102503637795791239662363267700850999572","281101623214958191570326342286046590671","191887113997405550783355770735353407072","249666793472843685948152908660510265202","260582223084869794443384764272472366872","321592979006532100708630908589420845227"]},"id":"CVE-2024-37901-0a516935","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/742cd4591642be4cdcaf68325f17540e0934e64e","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseObject.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["314246259094706491148575382837127759453","10818376345213815297116245890291092383","195397760480891384477449963909103615844","52762055478973007306390109292147329767"],"threshold":0.9},"id":"CVE-2024-37901-1962e39d","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/bbde8a4f564e3c28839440076334a9093e2b4834","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Object.java"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9ce3e0319869b6d8131fc4e0909736f7041566a4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Object.java"},"deprecated":false,"digest":{"line_hashes":["314246259094706491148575382837127759453","10818376345213815297116245890291092383","195397760480891384477449963909103615844","52762055478973007306390109292147329767"],"threshold":0.9},"id":"CVE-2024-37901-2b76a9ad","signature_type":"Line"},{"id":"CVE-2024-37901-2ca3b7c9","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/bbde8a4f564e3c28839440076334a9093e2b4834","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseObject.java"},"deprecated":false,"digest":{"line_hashes":["181206592806760174228566008667523864015","176669811463110203208316978837459847221","265457976098476163797035710965108330724","66027141029162381916987723313395333349","113460953889839962246598583683241058433","167863152323126058797535713195961477121","204078277445743465588132534169897462226","70660062906184790187707202900276158444","102503637795791239662363267700850999572","281101623214958191570326342286046590671","191887113997405550783355770735353407072","249666793472843685948152908660510265202","260582223084869794443384764272472366872","321592979006532100708630908589420845227"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9ce3e0319869b6d8131fc4e0909736f7041566a4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseObject.java"},"deprecated":false,"digest":{"line_hashes":["181206592806760174228566008667523864015","176669811463110203208316978837459847221","265457976098476163797035710965108330724","66027141029162381916987723313395333349","113460953889839962246598583683241058433","167863152323126058797535713195961477121","204078277445743465588132534169897462226","70660062906184790187707202900276158444","102503637795791239662363267700850999572","281101623214958191570326342286046590671","191887113997405550783355770735353407072","249666793472843685948152908660510265202","260582223084869794443384764272472366872","321592979006532100708630908589420845227"],"threshold":0.9},"id":"CVE-2024-37901-63628950"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0b135760514fef73db748986a3311f3edd4a553b","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Object.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["314246259094706491148575382837127759453","10818376345213815297116245890291092383","195397760480891384477449963909103615844","52762055478973007306390109292147329767"]},"id":"CVE-2024-37901-ac41cebd"},{"deprecated":false,"digest":{"line_hashes":["181206592806760174228566008667523864015","176669811463110203208316978837459847221","265457976098476163797035710965108330724","66027141029162381916987723313395333349","113460953889839962246598583683241058433","167863152323126058797535713195961477121","204078277445743465588132534169897462226","70660062906184790187707202900276158444","102503637795791239662363267700850999572","281101623214958191570326342286046590671","191887113997405550783355770735353407072","249666793472843685948152908660510265202","260582223084869794443384764272472366872","321592979006532100708630908589420845227"],"threshold":0.9},"id":"CVE-2024-37901-de065cc9","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0b135760514fef73db748986a3311f3edd4a553b","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseObject.java"}},{"deprecated":false,"digest":{"line_hashes":["314246259094706491148575382837127759453","10818376345213815297116245890291092383","195397760480891384477449963909103615844","52762055478973007306390109292147329767"],"threshold":0.9},"id":"CVE-2024-37901-df4efbd0","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/742cd4591642be4cdcaf68325f17540e0934e64e","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Object.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}