Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder beliebigen Programmcode auszuführen.
Product
XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen
Vulnerabilities 2
-
Critical 9.1CVE-2024-43400 Public exploit
XWiki Platform allows XSS through XClass name in string properties
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer …
-
Critical 9.1
In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user …
Revision history
-
#1
Initiale Fassung
References
-
Github Security Advisory GHSA-wcg9-pgqv-xm5v vom 2024-08-19
https://github.com/advisories/GHSA-wcg9-pgqv-xm5v
-
Github Security Advisory GHSA-f963-4cq8-2gw7 vom 2024-08-19
https://github.com/advisories/GHSA-f963-4cq8-2gw7