Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-41947

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.

Published

2024-07-31T16:15:04.540

Last Modified

2024-09-06T20:46:01.477

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.0 (CRITICAL)

Weaknesses

Type: Secondary
CWE-80
Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	xwiki	xwiki	< 15.10.8	Yes
Application	xwiki	xwiki	< 16.3.0	Yes

References

https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f Patch ([email protected])
https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34 Patch ([email protected])
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-692v-783f-mg8x Vendor Advisory ([email protected])
https://jira.xwiki.org/browse/XWIKI-21626 Issue Tracking, Vendor Advisory ([email protected])