CVE-2024-55876

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-55876", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-12-11T15:46:36.421Z", "datePublished": "2024-12-12T18:59:49.733Z", "dateUpdated": "2024-12-13T14:55:19.672Z"}, "containers": {"cna": {"title": "XWiki's scheduler in subwiki allows scheduling operations for any main wiki user", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}}], "references": [{"name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6"}, {"name": "https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331", "tags": ["x_refsource_MISC"], "url": "https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331"}, {"name": "https://jira.xwiki.org/browse/XWIKI-21663", "tags": ["x_refsource_MISC"], "url": "https://jira.xwiki.org/browse/XWIKI-21663"}], "affected": [{"vendor": "xwiki", "product": "xwiki-platform", "versions": [{"version": ">= 1.2-milestone-2, < 15.10.9", "status": "affected"}, {"version": ">= 16.0.0-rc-1, < 16.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-12T18:59:49.733Z"}, "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch."}], "source": {"advisory": "GHSA-cwq6-mjmx-47p6", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://jira.xwiki.org/browse/XWIKI-21663", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-13T14:52:05.467259Z", "id": "CVE-2024-55876", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-13T14:55:19.672Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "XWiki's scheduler in subwiki allows scheduling operations for any main wiki user", "source": {"advisory": "GHSA-cwq6-mjmx-47p6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "xwiki", "product": "xwiki-platform", "versions": [{"status": "affected", "version": ">= 1.2-milestone-2, < 15.10.9"}, {"status": "affected", "version": ">= 16.0.0-rc-1, < 16.3.0"}]}], "references": [{"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6", "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331", "name": "https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.xwiki.org/browse/XWIKI-21663", "name": "https://jira.xwiki.org/browse/XWIKI-21663", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-12T18:59:49.733Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-55876", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-13T14:52:05.467259Z"}}}], "references": [{"url": "https://jira.xwiki.org/browse/XWIKI-21663", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-12-13T14:52:11.232Z"}}]}, "cveMetadata": {"cveId": "CVE-2024-55876", "state": "PUBLISHED", "dateUpdated": "2024-12-12T18:59:49.733Z", "dateReserved": "2024-12-11T15:46:36.421Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-12-12T18:59:49.733Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "xwiki-platform", "vendor": "xwiki", "versions": [{"status": "affected", "version": ">= 1.2-milestone-2, < 15.10.9"}, {"status": "affected", "version": ">= 16.0.0-rc-1, < 16.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "matchCriteriaId": "11A53B9B-84DB-413A-AF66-B3548460777B", "versionEndExcluding": "15.10.9", "versionStartIncluding": "1.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki:*:-:*:*:*:*:*:*", "matchCriteriaId": "BE7E38B2-8E38-489D-9DB2-A3F5B140DA75", "versionEndExcluding": "16.3.0", "versionStartIncluding": "16.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki:1.2:-:*:*:*:*:*:*", "matchCriteriaId": "CBBFDB8B-806A-4AA7-B915-B47839326F52", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki:1.2:milestone2:*:*:*:*:*:*", "matchCriteriaId": "CFF6598F-C94E-4B0F-B4E6-0D0FF47F91A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki:1.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "8BC87D06-1D7C-42ED-8F7B-F345CBFE14A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki:1.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "F3314745-9F0D-4CC9-A58F-28C9F6524B98", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki:1.2:rc3:*:*:*:*:*:*", "matchCriteriaId": "A2A45F1B-9649-4681-9565-E5A0601E3014", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch."}, {"lang": "es", "value": "XWiki Platform es una plataforma wiki gen\u00e9rica. A partir de la versi\u00f3n 1.2-milestone-2 y antes de las versiones 15.10.9 y 16.3.0, cualquier usuario con una cuenta en la wiki principal pod\u00eda ejecutar operaciones de programaci\u00f3n en subwikis. Para reproducir, como usuario de la wiki principal sin ning\u00fan derecho especial, visualice el documento `Scheduler.WebHome` en una subwiki. Luego, haga clic en cualquier operaci\u00f3n (*por ejemplo,* Trigger) en cualquier trabajo. Si la operaci\u00f3n es exitosa, entonces la instancia es vulnerable. Esto ha sido corregido en XWiki 15.10.9 y 16.3.0. Como workaround, aquellos que tienen subwikis donde el Programador de trabajos est\u00e1 habilitado pueden editar los objetos en `Scheduler.WebPreferences` para que coincidan con el parche."}], "id": "CVE-2024-55876", "lastModified": "2026-06-17T08:11:23.663", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-55876", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-12-13T14:52:05.467259Z", "version": "2.0.3"}}]}, "published": "2024-12-12T19:15:14.140", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://jira.xwiki.org/browse/XWIKI-21663"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://jira.xwiki.org/browse/XWIKI-21663"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}