CVE-2024-55876

XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch.

• CWE-862

• https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21663Exploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21663Exploit, Vendor Advisory

Published

Dec 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5584The WordPress Online Booking and Scheduling Plugin – Bookly …6.4
• CVE-2024-5585In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.…8.8
• CVE-2024-5586Zohocorp ManageEngine ADAudit Plus versions below 8121 are v…8.8
• CVE-2024-55864Cross-site scripting vulnerability exists in My WP Customize…4.8
• CVE-2024-5587A vulnerability was found in Casdoor up to 1.335.0. It has b…6.9
• CVE-2024-55875http4k is a functional toolkit for Kotlin HTTP applications.…9.8
• CVE-2024-55877XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-55878SimpleXLSX is software for parsing and retrieving data from …6.8
• CVE-2024-55879XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-5588A vulnerability was found in itsourcecode Learning Managemen…8.8
• CVE-2024-55881In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-55884In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), an…9