Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
XWikiplatform Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2024-31985 - Vulnerability Database
XWikiplatform

XWikiplatform Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2024-31985

Medium
Reference: CVE-2024-31985
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-31985
Title: XWikiplatform Cross-Site Request Forgery (CSRF) Vulnerability
Overview:

XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20 15.5.4 and 15.10-rc-1 it is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL for example by embedding such an URL in any content as an image. The vulnerability has been fixed in XWiki 14.10.19 15.5.5 and 15.9. As a workaround manually apply the patch by modifying the Scheduler.WebHome page.