CVE-2024-41947

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

History

06 Sep 2024, 20:46

Type Values Removed Values Added
References () https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f - () https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f - Patch
References () https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34 - () https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34 - Patch
References () https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-692v-783f-mg8x - () https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-692v-783f-mg8x - Vendor Advisory
References () https://jira.xwiki.org/browse/XWIKI-21626 - () https://jira.xwiki.org/browse/XWIKI-21626 - Issue Tracking, Vendor Advisory
CWE CWE-79
CPE cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 9.0
v2 : unknown
v3 : 5.4
First Time Xwiki xwiki
Xwiki

01 Aug 2024, 12:42

Type Values Removed Values Added
Summary
  • (es) XWiki Platform es una plataforma wiki genérica que ofrece servicios de ejecución para aplicaciones creadas sobre ella. Al crear un conflicto cuando otro usuario con más derechos está editando una página, es posible ejecutar fragmentos de JavaScript del otro usuario, lo que compromete la confidencialidad, integridad y disponibilidad de toda la instalación de XWiki. Esto ha sido parcheado en XWiki 15.10.8 y 16.3.0RC1.

31 Jul 2024, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-31 16:15

Updated : 2024-09-06 20:46


NVD link : CVE-2024-41947

Mitre link : CVE-2024-41947

CVE.ORG link : CVE-2024-41947


JSON object : View

Products Affected

xwiki

  • xwiki
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)