Skip to content
OpenAdvisories
High NCSC-2024-0491 3 CVEs

Kwetsbaarheden verholpen in XWiki Platform

Published Dec 13, 2024 · Updated Dec 13, 2024 · nl

Vendor: xwiki Product: xwiki-platform

Summary

XWiki heeft kwetsbaarheden verholpen in de XWiki Platform (Specifiek voor versies 15.10.9 en 16.3.0).

Details

Interpretaties
De kwetsbaarheden bevinden zich in de manier waarop de XWiki Platform omgaat met gebruikersrechten. Een kwaadwillende gebruiker met programmatierechten kan code uitvoeren via de Extension Repository Application, of door het toevoegen van `XWiki.WikiMacroClass` en `XWiki.ConfigurableClass` instanties. Dit kan leiden tot het compromitteren van de gehele installatie. De kwetsbaarheden zijn verholpen in de versies 15.10.9 en 16.3.0.

Oplossingen
XWiki heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 3

  • Critical 10.0
    CVE-2024-55662

    XWiki allows remote code execution through the extension sheet

    XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the se…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-repository-server-ui Maven
  • Critical 10.0
    CVE-2024-55877

    XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList

    XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This co…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-help-ui Maven
  • Critical 9.1
    CVE-2024-55879

    XWiki allows RCE from script right in configurable sections

    XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises th…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-administration-ui Maven

Revision history

  1. #0

    Initiele versie

References