Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HSummary
CVE-2024-31986 is a critical-severity Eval Injection (CWE-95) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
XWiki Platform contains a remote code execution vulnerability affecting versions from 3.1 up to but not including 14.10.19, 15.5.4, and 15.10-rc-1. The flaw stems from insufficient validation of document references combined with XWiki.SchedulerJobClass objects, allowing crafted content to trigger arbitrary server-side code execution when the scheduler page is loaded or referenced.
An attacker with the ability to create documents in the wiki can exploit the issue. When an administrator subsequently visits the scheduler page or the malicious reference is rendered (for example through an embedded image in a comment), the attacker’s code runs with the privileges of the XWiki process, achieving full compromise of the server. The attack combines elements of improper neutralization of directives (CWE-95) and cross-site request forgery (CWE-352) and carries a CVSS 3.1 score of 9.0.
Public advisories and patches indicate the issue was resolved in XWiki 14.10.19, 15.5.5, and 15.9. The recommended workaround is to apply the provided patch directly to the Scheduler.WebHome page; the fixes are documented in the associated GitHub commits and the XWiki Jira ticket XWIKI-21416.
EPSS scores have remained low, reaching a peak of 0.1081 before receding to the current value of 0.0790, with no reported real-world exploitation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1076
Vulnerability Data
XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special crafted documented reference and an `XWiki.SchedulerJobClass` XObject, it is possible to execute arbitrary code…
more
on the server whenever an admin visits the scheduler page or the scheduler page is referenced, e.g., via an image in a comment on a page in the wiki. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, apply the patch manually by modifying the `Scheduler.WebHome` page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1V1.3.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code analysis can discover eval-injection flaws but does not stop their introduction.
Input validation explicitly requires neutralizing untrusted data before it reaches dynamic evaluation constructs such as eval.
Access enforcement requires verifying that state-changing requests originate from the authenticated user rather than a forged cross-site source.
Secure-development standards and tools can mandate safe coding patterns that avoid unsafe dynamic evaluation.
Protecting session authenticity prevents attackers from replaying or forging authenticated requests via the victim's browser.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and avoidance of unsafe dynamic evaluation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect eval injection vulnerabilities before deployment.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Secure development life cycle mandates input validation and safe coding practices that directly prevent eval injection.
Application security requirements include rules against dynamic code execution of untrusted input.
Secure architecture principles discourage unsafe dynamic evaluation constructs.
Secure coding explicitly requires neutralization of input before dynamic evaluation, directly mitigating eval injection.