CVE-2024-31982 Public exploit Critical · 10.0 EPSS 34.5%

XWiki Platform: Remote code execution as guest via DatabaseSearch

xwiki · xwiki-platform

Summary

The XWiki Platform (xwiki-platform) has a remote code execution flaw in its DatabaseSearch component, where the search text is improperly neutralized before being dynamically evaluated. An attacker who can reach the wiki over the network needs no authentication and no user interaction, since the database search is accessible to guests by default on public or closed wikis, so the flaw can be triggered as a visitor with the scope and impact of the whole XWiki installation affected.

Official description · CVE.org

XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.

Breakdown

66.7 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 11 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 months after disclosure.

Disclosed10 Apr 2024day 0
Public exploit codePoC-in-GitHub22 Jun 2024+2 mo
First seen exploitedVulnCheck KEV evidence25 Mar 2025+11 mo

See the family tree

4 related vulnerabilities in the same code over 22 months. The latest fix listed for xwiki-platform-search-ui is 15.10.2.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2023-29207Improper Neutralization of Script-Related HTML Tags (XSS) in the…15 Apr 2023
same family
CVE-2023-36469Code injection through NotificationRSSService in XWiki Platform29 Jun 2023
same family
This CVECVE-2024-31982XWiki Platform: Remote code execution as guest via…10 Apr 2024
relatedMedium
Why these are linked:
- Same code patched: DatabaseSearch.xml (machine-matched)commit 3c9e4bb commit 459e968 commit 67021db
CVE-2025-24893XWiki Platform Eval Injection20 Feb 2025KEV

Fixes in xwiki-platform-search-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

15.7-rc-1CVE-2023-5072115 Dec 2023
15.10-rc-1CVE-2024-3146510 Apr 2024
15.10-rc-1CVE-2024-3198210 Apr 2024
15.10.2CVE-2024-3790131 Jul 2024Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-search-ui.

Mavenorg.xwiki.platform:xwiki-platform-search-uiGHSA-2858-8cfx-69m9

Upgrade to 15.5.4

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2023-50721, CVE-2024-31465).

Also affected, despite being newer: 15.6-rc-1 up to 15.10-rc-1.

Set the version to 15.5.4 or later in your pom.xml or build.gradle.

The first fix for CVE-2024-31982.

Affected versions, by release line

If you run	Upgrade to
15.6-rc-1 up to 15.10-rc-1	15.10-rc-1
15.0-rc-1 up to 15.5.4	15.5.4
2.4-milestone-1 up to 14.10.20	14.10.20

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

8 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2024-1055

Public exploitAdvisories link exploit code.

, 30 Oct 2026

34.5%Top 1.6%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 98.4%).

3.1

10.0Critical · 10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 857 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9841 19.7/20

Threat reports0 reports 0.0/10

Public exploit code4 PoC-in-GitHub repos; 1 nuclei template 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 10 7.0/7

End-of-life productsupported or unknown 0.0

Total66.7

Record

Published: 10 Apr 2024
Modified: 25 Sep 2025
: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in xwiki-platform-search-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

x_refsource_CONFIRM 1

x_refsource_MISC 4

Other 3

techniques