Cyber Resilience

CVE-2024-31981

CriticalPublic PoC

Published: 10 April 2024

Published
10 April 2024
Modified
21 January 2025
KEV Added
Patch
CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.2414 96.2th percentile
Risk Priority 34 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-31981 is a critical-severity Missing Authorization (CWE-862) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.9 (Critical).

Operationally, ranked in the top 3.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

XWiki Platform, a generic wiki platform, contains a remote code execution vulnerability in its PDF export template handling. The flaw affects all versions from 3.0.1 through 14.10.19, 15.5.3, and 15.9, and stems from missing authorization checks (CWE-862) that allow untrusted input to influence template processing during PDF generation.

An authenticated attacker with low privileges can exploit the issue over the network by supplying a malicious PDF export template. Successful exploitation yields full remote code execution with impacts across confidentiality, integrity, and availability, and the vulnerability carries a CVSS score of 9.9 due to its scope-changing effects.

The official XWiki security advisory and associated patches recommend immediate upgrade to 14.10.20, 15.5.4, or 15.10-rc-1. Where PDF templates are not in use, administrators may create the document XWiki.PDFClass, ensure it lacks a style attribute, and restrict editing rights as a temporary control; the linked GitHub commits and Jira issue XWIKI-21337 document the precise code changes applied.

EPSS scores for this CVE rose from lower values after disclosure to a peak of 0.3368 on 2025-12-11 before receding to the current 0.2414, indicating measurable post-publication exploitation interest.

EU & UK References

Vulnerability details

XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, remote code execution is possible via PDF export templates. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10-rc-1. If…

more

PDF templates are not typically used on the instance, an administrator can create the document `XWiki.PDFClass` and block its edition, after making sure that it does not contain a `style` attribute. Otherwise, there are no known workarounds aside from upgrading.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

xwiki
xwiki
3.0.1 — 14.10.19 · 15.0 — 15.5.4 · 15.6 — 15.9

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-862

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

addresses: CWE-862

Reviews of access controls detect missing authorization checks on critical functions or resources.

addresses: CWE-862

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

addresses: CWE-862

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

addresses: CWE-862

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

addresses: CWE-862

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

addresses: CWE-862

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

addresses: CWE-862

Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.

References