CVE-2024-31982Xwiki Code Injection
XWiki Platform: Remote code execution as guest via DatabaseSearch
Published Apr 10, 2024 · Updated Oct 22, 2026 · Also known as GHSA-2858-8cfx-69m9
Key Facts
Patch immediately- CVE-2024-31982 is a critical-severity vulnerability (CVSS 10.0 v4) affecting Xwiki, org.xwiki.platform:xwiki-platform-search-ui (maven), xwiki-platform.
- It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Jun 26, 2024. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 35% probability of exploitation in the next 30 days.
- Fixed versions are available, including org.xwiki.platform:xwiki-platform-search-ui 14.10.20, org.xwiki.platform:xwiki-platform-search-ui 15.10-rc-1, org.xwiki.platform:xwiki-platform-search-ui 15.5.4.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v4
10.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS (30-day exploit likelihood)
35%
Higher than 98.4% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
56/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Jun 26, 2024
77 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
10
Reports of active use
Advisories And Exploit References
Description
XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page Main.DatabaseSearch. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CIRCL KEV | Jun 26, 2024 | n/a | Not reported |
| Industry KEV feed | Jun 26, 2024 | n/a | Not reported |
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| XwikiXwiki | See advisory | 14.10.20 |
| org.xwiki.platform:xwiki-platform-search-uimaven | >= 2.4-milestone-1 | 14.10.20 |
| xwiki-platform | >= 2.4-milestone-1, < 14.10.20 | n/a |
Patched Releases
org.xwiki.platform:xwiki-platform-search-ui
14.10.20, 15.10-rc-1, 15.5.4
Xwiki
14.10.20
Timeline
Publicly disclosed
Apr 10, 2024
Added to CIRCL KEV
Jun 26, 2024
Added to Industry KEV feed
Jun 26, 2024
Last updated
Oct 22, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2024-31982
- advisoryGHSA advisory
- exploitVulnCheck exploitation report
- articlevicarius.io · CVE-2024-31982
FAQ
Common Questions.
XWiki Platform is a generic wiki platform.
Affected: Xwiki; org.xwiki.platform:xwiki-platform-search-ui (maven) versions >= 2.4-milestone-1; xwiki-platform versions >= 2.4-milestone-1, < 14.10.20. The full list is in the CVE brief.
It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Jun 26, 2024.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including org.xwiki.platform:xwiki-platform-search-ui 14.10.20, org.xwiki.platform:xwiki-platform-search-ui 15.10-rc-1, org.xwiki.platform:xwiki-platform-search-ui 15.5.4.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2024-31982 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo