CVE-2024-31983

XWiki Platform is a generic wiki platform. In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are normally required for authoring translations (script right for user-scope translations, wiki admin for translations on the wiki). Starting in version 4.3-milestone-2 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, this can be exploited for remote code execution if the translation value is not properly escaped where it is used. This has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may restrict edit rights on documents that contain translations.

• CWE-862
• CWE-862

• https://github.com/xwiki/xwiki-platform/commit/2a9ce88f33663c53c9c63b2ea573f4720ea2efb9Patch
• https://github.com/xwiki/xwiki-platform/commit/73aef9648bbff04b697837f1b906932f0d5caacbPatch
• https://github.com/xwiki/xwiki-platform/commit/c4c8d61c30de72298d805ccc82df2a307f131c54Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xxp2-9c9g-7wmjVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21411Exploit, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/2a9ce88f33663c53c9c63b2ea573f4720ea2efb9Patch
• https://github.com/xwiki/xwiki-platform/commit/73aef9648bbff04b697837f1b906932f0d5caacbPatch
• https://github.com/xwiki/xwiki-platform/commit/c4c8d61c30de72298d805ccc82df2a307f131c54Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xxp2-9c9g-7wmjVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21411Exploit, Vendor Advisory

Published

Apr 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31978A vulnerability has been identified in SINEC NMS (All versio…7.6
• CVE-2024-31979Server-Side Request Forgery (SSRF) vulnerability in Apache S…4.3
• CVE-2024-3198The WP Font Awesome Share Icons plugin for WordPress is vuln…6.4
• CVE-2024-31980A vulnerability has been identified in Parasolid V35.1 (All …7.8
• CVE-2024-31981XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-31982XWiki Platform is a generic wiki platform. Starting in versi…9.8
• CVE-2024-31984XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-31985XWiki Platform is a generic wiki platform. Starting in versi…5.4
• CVE-2024-31986XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-31987XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-31988XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-31989Argo CD is a declarative, GitOps continuous delivery tool fo…9