Vulnerability record · CVE-2024-31984 · published 10 April 2024
CVE-2024-31984: XWiki Solr search space title Groovy code injection RCE
Xwiki · Xwiki
XWiki Platform versions from 7.2-rc-1 onward fail to sanitize space titles that are processed by the Solr-based search, allowing Groovy code injection. Any user who can edit a space title, which is all users by default, can execute arbitrary code on the server. The flaw is patched in 14.10.20, 15.5.4 and 15.10-rc-1.
Description
XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in XWiki. This allows any user who can edit the title of a space (all users by default) to execute any Groovy code in the XWiki installation which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the `Main.SolrSpaceFacet` page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote code execution with low privileges and no user interaction, high EPSS and public exploit references, though not in KEV.
What it is
XWiki Platform versions from 7.2-rc-1 onward fail to sanitize space titles that are processed by the Solr-based search, allowing Groovy code injection. Any user who can edit a space title, which is all users by default, can execute arbitrary code on the server. The flaw is patched in 14.10.20, 15.5.4 and 15.10-rc-1.
Impact
An attacker gains arbitrary Groovy code execution in the XWiki installation, compromising confidentiality, integrity and availability of the entire platform.
Attack surface
Reachable over the network through the web interface by creating or renaming a space with a crafted title; the CVSS vector shows low privileges required and no user interaction.
Exploitation
Not listed in CISA KEV, but EPSS is very high at 0.83 (99.7th percentile) and vendor advisory and Jira references are tagged Exploit, indicating public exploit detail exists.
What to do
- Upgrade to XWiki 14.10.20, 15.5.4 or 15.10-rc-1 or later
- If immediate upgrade is not possible, manually apply the patch to the Main.SolrSpaceFacet page as described in the advisory
- Restrict who can create or edit space titles until patched
- Review and remove any unexpected spaces or documents with unusual titles
- Monitor XWiki logs for Groovy execution errors or unexpected script activity
Detection
- Audit space and document titles for Groovy syntax or script-like payloads
- Monitor XWiki application logs for Groovy exceptions or unexpected code execution
- Alert on new or renamed spaces created by low-privileged accounts
- Track outbound or child process activity from the XWiki server that is not normal for the platform
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-31984 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-31984), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
