CVE-2024-31985: Xwiki platform scheduler ui XWiki Platform CSRF Vulnerability

MODERATE
Advisory Identifier: GHSA-j2r6-r929-v6gf
Share
CVSS 5.4
CWE-352
Published
Advisory Summary

CVE-2024-31985 is a MODERATE (CVSS 5.4) xwiki platform csrf vulnerability (CWE-352: Cross-Site Request Forgery (CSRF)) affecting Xwiki platform scheduler ui libraries in the Maven ecosystem. The issue involves xwiki platform csrf in the job scheduler. Remediation is available by upgrading affected packages to version 14.10.19, 15.5.4, 15.9.

CVE-2024-31985 at a Glance

CVE Identifier CVE-2024-31985
GHSA Identifier GHSA-j2r6-r929-v6gf
Severity MODERATE
CVSS v3.1 Base Score 5.4
CWE Classification CWE-352: Cross-Site Request Forgery (CSRF)
Affected Product Xwiki platform scheduler ui
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.4

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity Low (I:L)
Availability Low (A:L)

How to Fix CVE-2024-31985

To remediate this vulnerability, upgrade all affected Xwiki platform scheduler ui dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.xwiki.platform:xwiki-platform-scheduler-ui fixed: 14.10.19 
<dependency>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-scheduler-ui</artifactId>
    <version>14.10.19</version>
</dependency>
org.xwiki.platform:xwiki-platform-scheduler-ui fixed: 15.5.4 
<dependency>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-scheduler-ui</artifactId>
    <version>15.5.4</version>
</dependency>
org.xwiki.platform:xwiki-platform-scheduler-ui fixed: 15.9 
<dependency>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-scheduler-ui</artifactId>
    <version>15.9</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.xwiki.platform

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2024-31985, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.xwiki.platform

Analyze the terminal output to locate any version of Xwiki platform scheduler ui in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 14.10.19), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.xwiki.platform command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-352: Cross-Site Request Forgery (CSRF), where the web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. In Xwiki platform scheduler ui, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact It is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image. To reproduce in an XWiki installation, open `<xwiki-host>:/xwiki/bin/view/Scheduler/?do=trigger&which=Scheduler.NotificationEmailDailySender` as a user with admin rights. If there is no error message that indicates the CSRF token is invalid, the installation is vulnerable. ### Patches The vulnerability has been fixed on XWiki 14.10.19, 15.5.5, and 15.9. ### Workarounds Modify the Scheduler.WebHome page following this [patch](https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c#diff-1e2995eacccbbbdcc4987ff64f46ac74837d166cf9e92920b4a4f8af0f10bd47). ### References - https://jira.xwiki.org/browse/XWIKI-20851 - https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c

CVE-2024-31985 Affected Xwiki platform scheduler ui Versions

3 component(s)
Fixed Versions:
14.10.1915.5.415.9
Product / Package Ecosystem Affected Versions Fixed Version
org.xwiki.platform:xwiki-platform-scheduler-ui
maven/org.xwiki.platform/xwiki-platform-scheduler-ui
Maven
≥ 3.1
< 14.10.19
14.10.19
org.xwiki.platform:xwiki-platform-scheduler-ui
maven/org.xwiki.platform/xwiki-platform-scheduler-ui
Maven
≥ 15.0-rc-1
< 15.5.4
15.5.4
org.xwiki.platform:xwiki-platform-scheduler-ui
maven/org.xwiki.platform/xwiki-platform-scheduler-ui
Maven
≥ 15.6-rc-1
< 15.9
15.9

References

GitHub Advisory / Wiki ADVISORY
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2r6-r929-v6gf
NVD — CVE-2024-31985 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31985
Security Fix Commit FIX COMMIT
https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf
Security Fix Commit FIX COMMIT
https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87
Security Fix Commit FIX COMMIT
https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c
Security Fix Commit FIX COMMIT
https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269
Xwiki platform scheduler ui Source Repository REPOSITORY
https://github.com/xwiki/xwiki-platform
jira.xwiki.org/browse/xwiki-20851 WEB
https://jira.xwiki.org/browse/XWIKI-20851

Frequently Asked Questions

What is CVE-2024-31985?
CVE-2024-31985 is a security vulnerability in Xwiki platform scheduler ui involving XWiki Platform CSRF in the job scheduler under CWE-352: Cross-Site Request Forgery (CSRF).
Which Xwiki platform scheduler ui versions are affected?
Affected versions include releases prior to 14.10.19, 15.5.4, 15.9 across affected packages: org.xwiki.platform:xwiki-platform-scheduler-ui.
What version fixes CVE-2024-31985?
Upgrading to 14.10.19, 15.5.4, 15.9 (or the latest patched release for your respective branch) resolves the vulnerability.
Is xwiki-platform-scheduler-ui affected?
Yes, org.xwiki.platform:xwiki-platform-scheduler-ui is affected in releases prior to 14.10.19, 15.5.4, 15.9. Upgrade your dependency to 14.10.19, 15.5.4, 15.9 or later.
What is the CVSS score of CVE-2024-31985?
CVE-2024-31985 has a CVSS v3.1 base score of 5.4 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L.
What CWE is associated with CVE-2024-31985?
CVE-2024-31985 is classified under CWE-352: Cross-Site Request Forgery (CSRF) (The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.).
How can I check Maven dependencies for CVE-2024-31985?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.xwiki.platform'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j2r6-r929-v6gf",
  "modified" : "2024-04-10T22:01:24Z",
  "published" : "2024-04-10T17:14:12Z",
  "aliases" : [ "CVE-2024-31985" ],
  "summary" : "XWiki Platform CSRF in the job scheduler",
  "details" : "### Impact\nIt is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image.\n\nTo reproduce in an XWiki installation, open `<xwiki-host>:/xwiki/bin/view/Scheduler/?do=trigger&which=Scheduler.NotificationEmailDailySender` as a user with admin rights. If there is no error message that indicates the CSRF token is invalid, the installation is vulnerable.\n\n### Patches\nThe vulnerability has been fixed on XWiki 14.10.19, 15.5.5, and 15.9.\n\n### Workarounds\nModify the Scheduler.WebHome page following this [patch](https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c#diff-1e2995eacccbbbdcc4987ff64f46ac74837d166cf9e92920b4a4f8af0f10bd47).\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-20851\n- https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-scheduler-ui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.1"
      }, {
        "fixed" : "14.10.19"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-scheduler-ui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "15.0-rc-1"
      }, {
        "fixed" : "15.5.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.xwiki.platform:xwiki-platform-scheduler-ui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "15.6-rc-1"
      }, {
        "fixed" : "15.9"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2r6-r929-v6gf"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-31985"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/commit/8a92cb4bef7e5f244ae81eed3e64fe9be95827cf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/commit/efd3570f3e5e944ec0ad0899bf799bf9563aef87"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/commit/f16ca4ef1513f84ce2e685d4a05d689bd3a2ab4c"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/xwiki/xwiki-platform/commit/f30d9c641750a3f034b5910c6a3a7724ae8f2269"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/xwiki/xwiki-platform"
  }, {
    "type" : "WEB",
    "url" : "https://jira.xwiki.org/browse/XWIKI-20851"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-352" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-04-10T17:14:12Z",
    "nvd_published_at" : "2024-04-10T21:15:06Z"
  }
}