XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of XWiki.SearchSuggestConfig and XWiki.SearchSuggestSourceClass to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.21, 15.5.5 and 15.10.2.
CVE-2024-37901
CRITICALNVD 9.99.9
EchelonGraph scoreLOW confidence
This critical-severity CVE scores 9.9 under NVD CVSS v3. EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
Triggered by: NVD CVSS baseline
Sources: nvd
9.9
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
- High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS: 1%CVSS: 9.9Exploit: NoneExposed: 0
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 9.9
- EG Score
- 9.9(low)
- EPSS
- 60.5%
- KEV
- Not listed
Published
July 31, 2024
Last Modified
September 6, 2024
Advisory Details (6)
Auto-updated Jul 8, 2026Patch available. Sources: github_commit, github.
github Patch Available
Remote code execution from account via SearchSuggestConfigSheet · Advisory · xwiki/xwiki-platform · GitHub
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h63h-5c77-77p5github_commit
commit bbde8a4f564e (xwiki/xwiki-platform)
Fix landed in xwiki/xwiki-platform commit bbde8a4f564e — awaiting tagged release
https://github.com/xwiki/xwiki-platform/commit/bbde8a4f564e3c28839440076334a9093e2b4834github_commit
commit 9ce3e0319869 (xwiki/xwiki-platform)
Fix landed in xwiki/xwiki-platform commit 9ce3e0319869 — awaiting tagged release
https://github.com/xwiki/xwiki-platform/commit/9ce3e0319869b6d8131fc4e0909736f7041566a4github_commit Patch Available
commit 742cd4591642 (xwiki/xwiki-platform)
Patch available: xwiki/xwiki-platform xwiki-platform-17.10.2 (contains commit 742cd4591642)
https://github.com/xwiki/xwiki-platform/commit/742cd4591642be4cdcaf68325f17540e0934e64egithub_commit
commit 0b135760514f (xwiki/xwiki-platform)
Fix landed in xwiki/xwiki-platform commit 0b135760514f — awaiting tagged release
https://github.com/xwiki/xwiki-platform/commit/0b135760514fef73db748986a3311f3edd4a553bRelated CVEs(same CWE)
Same CWE
10 shownCWE-94
Frequently asked(5)
What is CVE-2024-37901?
CVE-2024-37901 is a critical vulnerability published on July 31, 2024. XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of XWiki.SearchSuggestConfig and XWiki.SearchSuggestSourceClass to their user profile or any…
When was CVE-2024-37901 disclosed?
CVE-2024-37901 was first published in the National Vulnerability Database on July 31, 2024, with the most recent update on September 6, 2024. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2024-37901 actively exploited?
CVE-2024-37901 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 60.5% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.
What is the CVSS score of CVE-2024-37901?
CVE-2024-37901 has a CVSS v3 base score of 9.9 (NVD). The EG score is currently aggregating — additional source signals are being incorporated as they become available..
How do I remediate CVE-2024-37901?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2024-37901, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2024-37901
Is Your Infrastructure Affected by CVE-2024-37901?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.