CVE-2024-31982: XWiki Platform: Remote code execution as guest via DatabaseSearch
- Is it exploited?
Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .
VulnCheck KEV lists it since . It cites 16 public reports, the first from . VulnCheck's own honeypots also recorded exploitation attempts.
- How likely is exploitation in the next 30 days?
- 34.5%
EPSS score, percentile 98.4 of all scored records. A probability estimated by FIRST, not a report of exploitation.
CISA's SSVC assessment in the CVE record lists exploitation as poc.
- How severe?
- 10.0 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- >= 2.4-milestone-1, < 14.10.20
- >= 15.0-rc-1, < 15.5.4
- >= 15.6-rc-1, < 15.10-rc-1
Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
XWiki Platform: Remote code execution as guest via DatabaseSearch
XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (1 product)
| Status | Versions |
|---|---|
| Affected | >= 2.4-milestone-1, < 14.10.20 |
| Affected | >= 15.0-rc-1, < 15.5.4 |
| Affected | >= 15.6-rc-1, < 15.10-rc-1 |
Source: CVE List, as of . About the data.
Weakness
CWE-95
- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
6
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2858-8cfx-69m9
- https://github.com/xwiki/xwiki-platform/commit/3c9e4bb04286de94ad24854026a09fa967538e31
- https://github.com/xwiki/xwiki-platform/commit/459e968be8740c8abc2a168196ce21e5ba93cfb8
- https://github.com/xwiki/xwiki-platform/commit/95bdd6cc6298acdf7f8f21298d40eeb8390a8565
- https://jira.xwiki.org/browse/XWIKI-21472
- vicarius.io
Known exploited XWiki vulnerabilities
- CVE-2025-24893: XWiki Platform Eval Injection Vulnerability