What is CVE-2024-31983?

CVE-2024-31983 is a critical-severity vulnerability in Xwiki, classified under Missing Authorization. CVSS score: 9.9/10. Published 2024-04-10.

How severe is CVE-2024-31983?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Is CVE-2024-31983 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Xwiki

CVE-2024-31983

XWiki Platform is a generic wiki platform. In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are normally required for authoring translations (script right for user-scope translations, wiki admin for translations on the wiki). Starting in version 4.3-milestone-2 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, this can be exploited for remote code execution if the translation value is not properly escaped where it is used. This has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may restrict edit rights on documents that contain translations.

Vulnerability class: Broken Access Control

Published 2024-04-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.014 (72.3th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000

Affected products

Xwiki — versions 4.3
Xwiki Xwiki-Platform — versions >= 4.3-milestone-2, < 14.10.20, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

github.com/xwiki/xwiki-platform/security/advisories/GHSA-xxp2-9c9g-7wmj (Vendor Advisory)
github.com/xwiki/xwiki-platform/commit/2a9ce88f33663c53c9c63b2ea573f4720ea2efb9 (Patch)
github.com/xwiki/xwiki-platform/commit/73aef9648bbff04b697837f1b906932f0d5caacb (Patch)
github.com/xwiki/xwiki-platform/commit/c4c8d61c30de72298d805ccc82df2a307f131c54 (Patch)
jira.xwiki.org/browse/XWIKI-21411 (Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2024-31983?: CVE-2024-31983 is a critical-severity vulnerability in Xwiki, classified under Missing Authorization. CVSS score: 9.9/10. Published 2024-04-10.
How severe is CVE-2024-31983?: Critical severity. CVSS v3 base score is 9.9 out of 10.
Is CVE-2024-31983 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.