CVE-2024-55876 XWiki's scheduler in subwiki allows scheduling operations for any main wiki user
Main wiki users can execute scheduler operations on subwikis without proper authorization, allowing unauthorized job triggers and potential privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-55876?
CVE-2024-55876 is a medium-severity missing authorization vulnerability in Xwiki Xwiki, published on 12 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch.
Weakness: CWE-862
Which versions are affected by CVE-2024-55876?
4 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-scheduler-ui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.xwiki.platform:xwiki-platform-scheduler-ui Maven | From 1.2-milestone-2 | 15.10.9 |
org.xwiki.platform:xwiki-platform-scheduler-ui Maven | From 1.2-milestone-2 | 15.10.9 |
org.xwiki.platform:xwiki-platform-scheduler-ui Maven | From 16.0.0-rc-1 | 16.3.0 |
org.xwiki.platform:xwiki-platform-scheduler-ui Maven | From 16.0.0-rc-1 | 16.3.0 |
Products include Xwiki Xwiki.
How do I fix CVE-2024-55876?
Upgrade org.xwiki.platform:xwiki-platform-scheduler-ui to a fixed version for your release line: 15.10.9 or 16.3.0.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-55876 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-55876 exists.
Other vulnerabilities in Xwiki Xwiki
- CVE-2025-24893 XWiki Platform Eval Injection
- CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros
- CVE-2024-55662 XWiki allows remote code execution through the extension sheet
- CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
- CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
Sources
Also known as GHSA-cwq6-mjmx-47p6.