Incorrect Privilege Assignment in XWiki platform - CVE-2024-37899
Published: June 20, 2024 / Updated: April 9, 2026
Vulnerability identifier: #VU125599
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-37899
CWE-ID: CWE-266
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in the user profile handling during account disabling when an administrator disables a user account containing crafted profile content. A remote user can place malicious code in the user profile to execute arbitrary code.
User interaction is required because an administrator must disable the user account.
Affected software
XWiki platform
How to mitigate CVE-2024-37899
Install security update from vendor's website.
XWiki platform - addressed in versions 14.10.21, 15.5.5, 15.10.6, 16.0.0