Skip to content
OpenAdvisories
High WID-SEC-2024-1738 4 CVEs

xwiki: Mehrere Schwachstellen

Published Jul 31, 2024 · Updated Jul 31, 2024 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen und beliebigen Code auszuführen.

Product

XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen

Vulnerabilities 4

  • Critical 10.0
    CVE-2024-37901

    XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of `XWiki.SearchSuggestConfig` and `XWiki.SearchSugge…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-search-ui Maven
  • Critical 9.1
    CVE-2024-41947 Public exploit

    XWiki Platform XSS through conflict resolution

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the ot…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-web-templates Maven
  • Medium 6.4
    CVE-2024-37900 EPSS 16%

    XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the …

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-web-war Maven
  • Medium 4.3
    CVE-2024-37898

    XWiki Platform vulnerable to document deletion and overwrite from edit

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in XWiki, that user can delete the page and replace it by a page with new content without having delete …

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore Maven

Revision history

  1. #1

    Initiale Fassung

References