CVE-2024-31987
1 advisory.
Maven/org.xwiki.platform:xwiki-platform-oldcore CVE-2024-31987: critical 9.9
XWiki Platform remote code execution from account via custom skins support
Action: Upgrade org.xwiki.platform:xwiki-platform-oldcore to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.4-milestone-1 | 14.10.19 | - |
| 15.0-rc-1 | 15.5.4 | - |
| 15.6-rc-1 | 15.10-rc-1 | - |
Fixed versions
| 14.10.19 | 15.5.4 | 15.10-rc-1 |
Sources
- osv: GHSA-cv55-v6rw-7r5v
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cv55-v6rw-7r5v
- https://nvd.nist.gov/vuln/detail/CVE-2024-31987
- https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39
- https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2
- https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-21478
CVE-2024-31987 · published · modified · JSON