{"id":"CVE-2024-55876","summary":"XWiki's scheduler in subwiki allows scheduling operations for any main wiki user","details":"XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch.","aliases":["GHSA-cwq6-mjmx-47p6"],"modified":"2026-08-12T15:15:44.262115Z","published":"2024-12-12T18:59:49.733Z","database_specific":{"cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55876.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-21663"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55876.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55876"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"3f100aee4c197e68d2986717a878d0bbd4fb0c22"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"ed06afe4614a2782ddac6e42ed21f180056a206e"},{"introduced":"99d58d81092b47c5076d07041c1beec93f07d051"},{"last_affected":"99d58d81092b47c5076d07041c1beec93f07d051"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:*:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:1.2:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.2.1"},{"fixed":"15.10.9"},{"introduced":"16.0.0"},{"fixed":"16.3.0"},{"introduced":"1.2-NA"},{"last_affected":"1.2-NA"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"b8d53d613cc472054198880bf2720ce3884d926a"},{"fixed":"1c4b9ba5f04cd8d636a6718465a0b8e251f51420"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"50fb1f191827504c6173697d6c39aa093301a851"},{"introduced":"a68e2d6f3d26bf76499502626f29ca0138f62089"},{"fixed":"54bcc5a7a2e440cc591b91eece9c13dc0c487331"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:*:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:1.2:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:1.2:milestone2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.2.1"},{"fixed":"15.10.9"},{"introduced":"16.0.0"},{"fixed":"16.3.0"},{"introduced":"1.2-NA"},{"last_affected":"1.2-NA"},{"introduced":"1.2-milestone2"},{"last_affected":"1.2-milestone2"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["1.2-NA","1.2-milestone2","xwiki-commons-16.3.0-rc-1","xwiki-commons-15.10.8","xwiki-commons-15.10.7","xwiki-commons-15.10.6","xwiki-commons-15.10.5","xwiki-commons-15.10.4","xwiki-commons-15.10.3","xwiki-commons-15.10.2","xwiki-commons-15.10.1","xwiki-commons-15.10","xwiki-commons-15.10-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-commons-license-resources-1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55876.json","vanir_signatures_modified":"2026-08-12T15:15:44Z","vanir_signatures":[{"digest":{"length":1349,"function_hash":"320699107581045178202029475314457317510"},"id":"CVE-2024-55876-64018ff1","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-ui/src/test/java/org/xwiki/scheduler/ui/SchedulerPageTest.java","function":"setUp"},"deprecated":false},{"source":"https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331","target":{"file":"xwiki-platform-core/xwiki-platform-scheduler/xwiki-platform-scheduler-ui/src/test/java/org/xwiki/scheduler/ui/SchedulerPageTest.java"},"deprecated":false,"digest":{"line_hashes":["46160026413921582650173818823406653908","53394366996646667747230855980354624906","328475681764110367668589555051324554285","93757110941715075689404303730189585394","2945587470618018015807513154073979190","223659179877606088847008751106187876147","117590846199278513449966482990812237134","43376088918460774220711317085128669976","298879766897520214873839442708812904055","275296427927977162491138040574253409185","32716400321826755511660945267566513297","9101197268986673535591384068308652669","135547552173379052912357377076235266742","173665972753598113912933213513314952833","201731330622560764930679738265060345690","163667138149446606057957718696297844299","133418458471533577780772821660904057879","206941301287037684489017932711097277881","166173430592326304272808121030693592298","139291846678229305091523637256576183177","321866523414477752185910432791875176648","328233122640759864520580522136597488730","75507021343667284522501236673242030840","86621556755989173500902081581790208064"],"threshold":0.9},"id":"CVE-2024-55876-984dcf7a","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}]}