Vulnerability Database
296,772
Total vulnerabilities in the database
CVE-2024-55876
XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document Scheduler.WebHome in a subwiki. Then, click on any operation (e.g., Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on Scheduler.WebPreferences to match the patch.
| Software | From | Fixed in |
|---|---|---|
| xwiki / xwiki | 1.2.1 | 15.10.9 |
| xwiki / xwiki | 16.0.0 | 16.3.0 |
| xwiki / xwiki | 1.2 | 1.2.x |
| xwiki / xwiki | 1.2-milestone2 | 1.2-milestone2.x |
| xwiki / xwiki | 1.2-rc1 | 1.2-rc1.x |
| xwiki / xwiki | 1.2-rc2 | 1.2-rc2.x |
| xwiki / xwiki | 1.2-rc3 | 1.2-rc3.x |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime