Vulnerability · Published Jul 31, 2024 · Assigned by GitHub_M

CVE-2024-41947XWiki Platform XSS through conflict resolution

Critical 9.1

In plain English

A critical-severity security flaw in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)1.7%top 23.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.xwiki.platform:xwiki-platform-web-templates	15.10.8	GHSA-692v-783f-mg8x
Maven	org.xwiki.platform:xwiki-platform-web-templates	16.3.0-rc-1	GHSA-692v-783f-mg8x

Affected products (as reported)

Vendor	Product	Versions
xwiki	xwiki-platform	>= 11.8-rc-1, < 15.10.8>= 16.0.0-rc-1, < 16.3.0-rc-1

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-692v-783f-mg8x x_refsource_CONFIRM
https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f x_refsource_MISC
https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34 x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-21626 x_refsource_MISC