{"url":"http://public2.vulnerablecode.io/api/packages/69726?format=json","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@6.4-milestone-1","type":"maven","namespace":"org.xwiki.platform","name":"xwiki-platform-oldcore","version":"6.4-milestone-1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"12.10.6","latest_non_vulnerable_version":"15.10-rc-1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47447?format=json","vulnerability_id":"VCID-rpvk-g9y1-yucv","summary":"XWiki Platform remote code execution from account via custom skins support\nAny user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote code execution.\n\nTo reproduce, as a user without edit, script or admin right, add an object of class `XWiki.XWikiSkins` to your profile. Name it whatever you want and set the Base Skin to `flamingo`.\nAdd an object of class `XWikiSkinFileOverrideClass` and set the path to `macros.vm` and the content to:\n```","references":[{"reference_url":"https://github.com/xwiki/xwiki-platform","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/xwiki/xwiki-platform"},{"reference_url":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/xwiki/xwiki-platform/commit/3d4dbb41f52d1a6e39835cfb1695ca6668605a39"},{"reference_url":"https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/xwiki/xwiki-platform/commit/626d2a5dbf95b4e719ae13bf1a0a9c76e4edd5a2"},{"reference_url":"https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/xwiki/xwiki-platform/commit/da177c3c972e797d92c1a31e278f946012c41b56"},{"reference_url":"https://jira.xwiki.org/browse/XWIKI-21478","reference_id":"","reference_type":"","scores":[],"url":"https://jira.xwiki.org/browse/XWIKI-21478"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31987","reference_id":"CVE-2024-31987","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31987"},{"reference_url":"https://github.com/advisories/GHSA-cv55-v6rw-7r5v","reference_id":"GHSA-cv55-v6rw-7r5v","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-cv55-v6rw-7r5v"},{"reference_url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cv55-v6rw-7r5v","reference_id":"GHSA-cv55-v6rw-7r5v","reference_type":"","scores":[],"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cv55-v6rw-7r5v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69694?format=json","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@14.10.19","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@14.10.19"},{"url":"http://public2.vulnerablecode.io/api/packages/69695?format=json","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.5.4","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.5.4"},{"url":"http://public2.vulnerablecode.io/api/packages/69712?format=json","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.10-rc-1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.10-rc-1"}],"aliases":["CVE-2024-31987","GHSA-cv55-v6rw-7r5v"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rpvk-g9y1-yucv"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@6.4-milestone-1"}