Cross-site request forgery in XWiki platform - CVE-2024-31988
Published: April 10, 2024 / Updated: May 5, 2026
Vulnerability identifier: #VU129906
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-31988
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to cross-site request forgery in the RTFrontend.ConvertHTML realtime HTML Converter API when handling crafted requests that cause an admin user to visit a crafted URL or view an image with that URL. A remote attacker can send a specially crafted URL to execute arbitrary code.
User interaction is required, and exploitation requires an admin user with programming right to visit the crafted URL or view an image containing that URL.
Affected software
XWiki platform
How to mitigate CVE-2024-31988
Install security update from vendor's website.
XWiki platform - addressed in versions 14.10.19, 15.5.4, 15.9