CVE-2024-41947
published 2024-07-31CVE-2024-41947: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more…
PriorityP335medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EXPLOIT
EPSS
1.57%
72.3th percentile
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | >= 11.8 < 15.10.8 | 15.10.8 |
| xwiki | xwiki | >= 16.0 < 16.3.0 | 16.3.0 |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
ghsa·2024-07-31
CVE-2024-41947 [CRITICAL] CWE-79 XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
### Impact
By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce on a XWiki instance, a user with admin rights needs to edit a document without saving right away.
Then, as another user without any other right than edit on the specific document, change the whole content to `alert('XSS')`.
When the admin user then saves the document, a conflict popup appears. If they select "Fix each conflict individually" and see an alert displaying "XSS", then the instance is vulnerable.
### Patches
T
OSV
XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
osv·2024-07-31
CVE-2024-41947 [CRITICAL] XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
### Impact
By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce on a XWiki instance, a user with admin rights needs to edit a document without saving right away.
Then, as another user without any other right than edit on the specific document, change the whole content to `alert('XSS')`.
When the admin user then saves the document, a conflict popup appears. If they select "Fix each conflict individually" and see an alert displaying "XSS", then the instance is vulnerable.
### Patches
T
No detection rules found.
No writeups or analysis indexed.
2024-07-31
Published