--- title: "Security digest: April 10, 2024" url: https://erroneo.us/security/2024-04-10/ description: "April 10, 2024 vulnerability digest: 17 critical advisories (Maven, Go, PyPI, Composer…). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-04-10 date_modified: 2024-04-10 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: April 10, 2024 17 critical advisories. ## Take stock - Maven: 10 critical advisories ( org.xwiki.platform:xwiki-platform-localization-source-wiki , org.xwiki.platform:xwiki-platform-search-solr-ui , org.xwiki.platform:xwiki-platform-oldcore , org.xwiki.platform:xwiki-platform-realtime-ui , org.xwiki.commons:xwiki-commons-velocity , org.xwiki.platform:xwiki-platform-uiextension-api , org.xwiki.platform:xwiki-platform-scheduler-ui , org.xwiki.platform:xwiki-platform-search-ui ). Check with mvn dependency:tree -Dincludes=: . - PyPI: 3 critical advisories ( llama-index-core , aim , litellm ). Check with pip-audit (or: pip show ) . - Go: 2 critical advisories ( github.com/go-skynet/LocalAI , github.com/evmos/evmos/v16 , github.com/evmos/evmos/v7 , github.com/evmos/evmos/v6 , github.com/evmos/evmos/v5 , github.com/tharsis/evmos , github.com/tharsis/evmos/v2 , github.com/tharsis/evmos/v3 …). Check with govulncheck ./... . - Composer (PHP): 1 critical advisory ( wwbn/avideo ). Check with composer audit . - npm: 1 critical advisory ( mysql2 ). Check with npm audit (or: npm ls ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-31983](https://erroneo.us/security/cve/CVE-2024-31983/index.md) XWiki Platform: Remote code execution from edit in multilingual wikis via translations — Maven org.xwiki.platform:xwiki-platform-localization-source-wiki >= 4.3-milestone-2, < 14.10.20 → 14.10.20; Maven org.xwiki.platform:xwiki-platform-localization-source-wiki >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.platform:xwiki-platform-localization-source-wiki >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1 - [CVE-2024-31984](https://erroneo.us/security/cve/CVE-2024-31984/index.md) XWiki Platform: Remote code execution through space title and Solr space facet — Maven org.xwiki.platform:xwiki-platform-search-solr-ui >= 7.2-rc-1, < 14.10.20 → 14.10.20; Maven org.xwiki.platform:xwiki-platform-search-solr-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.platform:xwiki-platform-search-solr-ui >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1 - [CVE-2024-2029](https://erroneo.us/security/cve/CVE-2024-2029/index.md) LocalAI Command Injection in audioToWav — Go github.com/go-skynet/LocalAI < 2.10.0 → 2.10.0 - [CVE-2024-3098](https://erroneo.us/security/cve/CVE-2024-3098/index.md) llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution — PyPI llama-index-core < 0.10.24 → 0.10.24 - [CVE-2024-31981](https://erroneo.us/security/cve/CVE-2024-31981/index.md) XWiki Platform: Privilege escalation (PR) from user registration through PDFClass — Maven org.xwiki.platform:xwiki-platform-oldcore >= 3.0.1, < 14.10.20 → 14.10.20; Maven org.xwiki.platform:xwiki-platform-oldcore >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.platform:xwiki-platform-oldcore >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1 - [CVE-2024-31988](https://erroneo.us/security/cve/CVE-2024-31988/index.md) XWiki Platform CSRF remote code execution through the realtime HTML Converter API — Maven org.xwiki.platform:xwiki-platform-realtime-ui >= 13.9-rc-1, < 14.10.19 → 14.10.19; Maven org.xwiki.platform:xwiki-platform-realtime-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.platform:xwiki-platform-realtime-ui >= 15.6-rc-1, < 15.9 → 15.9 - [CVE-2024-2195](https://erroneo.us/security/cve/CVE-2024-2195/index.md) Aim Web API vulnerable to Remote Code Execution — PyPI aim >= 3.0.0, <= 3.25.0 → no fix - [CVE-2024-31819](https://erroneo.us/security/cve/CVE-2024-31819/index.md) WWBN AVideo Remote Code Execution — Composer (PHP) wwbn/avideo >= 12.4, <= 14.2 → 14.3 - [CVE-2024-31996](https://erroneo.us/security/cve/CVE-2024-31996/index.md) XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution — Maven org.xwiki.commons:xwiki-commons-velocity >= 3.0.1, < 14.10.19 → 14.10.19; Maven org.xwiki.commons:xwiki-commons-velocity >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.commons:xwiki-commons-velocity >= 15.6-rc-1, < 15.9-rc-1 → 15.9-rc-1 - [CVE-2024-21508](https://erroneo.us/security/cve/CVE-2024-21508/index.md) mysql2 Remote Code Execution (RCE) via the readCodeFor function — npm mysql2 < 3.9.4 → 3.9.4 - [CVE-2024-31987](https://erroneo.us/security/cve/CVE-2024-31987/index.md) XWiki Platform remote code execution from account via custom skins support — Maven org.xwiki.platform:xwiki-platform-oldcore >= 6.4-milestone-1, < 14.10.19 → 14.10.19; Maven org.xwiki.platform:xwiki-platform-oldcore >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.platform:xwiki-platform-oldcore >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1 - [CVE-2024-31997](https://erroneo.us/security/cve/CVE-2024-31997/index.md) XWiki Platform remote code execution from account through UIExtension parameters — Maven org.xwiki.platform:xwiki-platform-uiextension-api < 14.10.19 → 14.10.19; Maven org.xwiki.platform:xwiki-platform-uiextension-api >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.platform:xwiki-platform-uiextension-api >= 15.6-rc-1, < 15.9-rc-1 → 15.9-rc-1 - [CVE-2024-2952](https://erroneo.us/security/cve/CVE-2024-2952/index.md) LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint — PyPI litellm < 1.34.42 → 1.34.42 - [CVE-2024-32644](https://erroneo.us/security/cve/CVE-2024-32644/index.md) Evmos transaction execution not accounting for all state transition after interaction with precompiles — Go github.com/evmos/evmos/v16 <= 16.0.4 → 17.0.0; Go github.com/evmos/evmos/v7 <= 7.0.0 → no fix; Go github.com/evmos/evmos/v6 <= 6.0.4 → no fix - [CVE-2024-31986](https://erroneo.us/security/cve/CVE-2024-31986/index.md) XWiki Platform CSRF remote code execution through scheduler job's document reference — Maven org.xwiki.platform:xwiki-platform-scheduler-ui >= 3.1, < 14.10.19 → 14.10.19; Maven org.xwiki.platform:xwiki-platform-scheduler-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.platform:xwiki-platform-scheduler-ui >= 15.6-rc-1, < 15.9 → 15.9 - [CVE-2024-31465](https://erroneo.us/security/cve/CVE-2024-31465/index.md) XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet — Maven org.xwiki.platform:xwiki-platform-search-ui >= 5.2-milestone-2, < 14.10.20 → 14.10.20; Maven org.xwiki.platform:xwiki-platform-search-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.platform:xwiki-platform-search-ui >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1 - [CVE-2024-31982](https://erroneo.us/security/cve/CVE-2024-31982/index.md) XWiki Platform: Remote code execution as guest via DatabaseSearch — Maven org.xwiki.platform:xwiki-platform-search-ui >= 2.4-milestone-1, < 14.10.20 → 14.10.20; Maven org.xwiki.platform:xwiki-platform-search-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; Maven org.xwiki.platform:xwiki-platform-search-ui >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1 --- Source page: https://erroneo.us/security/2024-04-10/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt