CVE-2024-45591
published 2024-09-10CVE-2024-45591: XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information…
PriorityP339medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
3.42%
87.4th percentile
XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | >= 1.8 < 15.10.9 | 15.10.9 |
| xwiki | xwiki | >= 16.0.0 < 16.3.0 | 16.3.0 |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Send a GET request to /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history and check for HTTP 200 with body containing all of: 'version', 'historySummary', 'pageId', 'comment' — presence confirms unauthenticated history disclosure.
- →The vulnerable REST API endpoint pattern is /xwiki/rest/wikis/{wiki}/spaces/{space}/pages/{page}/history — monitor for unauthenticated or unauthorized access to any URL matching this pattern. ↗
- →Use the Shodan dork 'http.html:"data-xwiki-reference"' to identify internet-exposed XWiki instances that may be vulnerable.
- ·The vulnerability is exploitable even on wikis configured as fully private — access rights configuration does NOT prevent exposure of the history endpoint. ↗
- ·No workarounds are available for unpatched versions; the only remediation is upgrading to XWiki 15.10.9 or 16.3.0RC1+.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
XWiki Platform document history including authors of any page exposed to unauthorized actors
ghsa·2024-09-10
CVE-2024-45591 [MEDIUM] CWE-359 XWiki Platform document history including authors of any page exposed to unauthorized actors
XWiki Platform document history including authors of any page exposed to unauthorized actors
### Impact
The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private.
On a private wiki, this can be tested by accessing `/xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history`, if this shows the history of the main page then the installation is vulnerable.
### Patches
This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.
### Workar
OSV
XWiki Platform document history including authors of any page exposed to unauthorized actors
osv·2024-09-10
CVE-2024-45591 [MEDIUM] XWiki Platform document history including authors of any page exposed to unauthorized actors
XWiki Platform document history including authors of any page exposed to unauthorized actors
### Impact
The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private.
On a private wiki, this can be tested by accessing `/xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history`, if this shows the history of the main page then the installation is vulnerable.
### Patches
This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.
### Workar
No detection rules found.
Nuclei
XWiki Platform - Unauthorized Document History Access
nuclei·CVSS 5.3
CVE-2024-45591 [MEDIUM] XWiki Platform - Unauthorized Document History Access
XWiki Platform - Unauthorized Document History Access
A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details (username and display name), and version comments, regardless of access rights configuration, even on private wikis.
Template:
id: CVE-2024-45591
info:
name: XWiki Platform - Unauthorized Document History Access
author: pd-bot
severity: medium
description: |
A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details (username and display name),
No writeups or analysis indexed.
2024-09-10
Published