CVE-2024-43401
published 2024-08-19CVE-2024-43401: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a…
PriorityP341high8CVSS 3.1
AVNACLPRLUIRSUCHIHAH
EPSS
0.64%
46.1th percentile
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | <= 15.9 | — |
| xwiki | xwiki-platform | < 15.10-rc-1 | 15.10-rc-1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
ghsa·2024-08-19
CVE-2024-43401 [CRITICAL] CWE-269 In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
### Impact
A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor.
The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content.
The payload is executed at edit time.
### Patches
This vulnerability has been patched in XWiki 15.10RC1.
### Workarounds
No workaround. It is advised to upgrade to XWiki 15.10+.
### References
* https://jira.xwiki.org/browse/XWIKI-20331
* https://jira.xwiki.org/browse/XWIKI-21311
* https://jira.xwiki.org/browse/XWIKI-21481
* https://jira.xwiki.org/browse/XWIKI-21482
* https://jira.xwiki.org/browse/XWIKI-21483
*
OSV
In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
osv·2024-08-19
CVE-2024-43401 [CRITICAL] In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
### Impact
A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor.
The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content.
The payload is executed at edit time.
### Patches
This vulnerability has been patched in XWiki 15.10RC1.
### Workarounds
No workaround. It is advised to upgrade to XWiki 15.10+.
### References
* https://jira.xwiki.org/browse/XWIKI-20331
* https://jira.xwiki.org/browse/XWIKI-21311
* https://jira.xwiki.org/browse/XWIKI-21481
* https://jira.xwiki.org/browse/XWIKI-21482
* https://jira.xwiki.org/browse/XWIKI-21483
*
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7https://jira.xwiki.org/browse/XWIKI-20331https://jira.xwiki.org/browse/XWIKI-21311https://jira.xwiki.org/browse/XWIKI-21481https://jira.xwiki.org/browse/XWIKI-21482https://jira.xwiki.org/browse/XWIKI-21483https://jira.xwiki.org/browse/XWIKI-21484https://jira.xwiki.org/browse/XWIKI-21485https://jira.xwiki.org/browse/XWIKI-21486https://jira.xwiki.org/browse/XWIKI-21487https://jira.xwiki.org/browse/XWIKI-21488https://jira.xwiki.org/browse/XWIKI-21489https://jira.xwiki.org/browse/XWIKI-21490
2024-08-19
Published