CVE-2024-3199610.0CriticalCWE-95

CVE-2024-31996: XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

xwiki · xwiki-commons

Affected: xwiki-commons · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

2.1%probability of exploitation in the next 30 days

82nd percentile

050100

Higher than 82% of scored CVEs

10.0CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool that is used in XWiki doesn't escape `{`, which, when used in certain places, allows XWiki syntax injection and thereby remote code execution. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9 RC1. Apart from upgrading, there is no generic workaround. However, replacing `$escapetool.html` by `$escapetool.xml` in XWiki documents fixes the vulnerability. In a standard XWiki installation, the maintainers are only aware of the document `Panels.PanelLayoutUpdate` that exposes this vulnerability, patching this document is thus a workaround. Any extension could expose this vulnerability and might thus require patching, too.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

xwiki · xwiki-commons>= 3.0.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Neutralization of Directives in Dynamically Evaluated Code · Command and Code Injection
Vendor: xwiki
Published: April 2024
Band: Possible (1 to 10%), April 2024

CoverageNo articles yet

No CyberSIXT article names CVE-2024-31996 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.