PT-2024-24095 · Xwiki · Xwiki Platform

Simon Urli · Published 2024-04-10 · Updated 2025-01-09 · CVE-2024-31464

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 5.0-rc-1 through 14.10.18 XWiki Platform versions 14.10.19 through 15.5.3 XWiki Platform versions 15.5.4 through 15.9-rc-1

Description The issue allows access to the hash of a password by using the diff feature of the history whenever the object storing the password is deleted. An attacker with rights to edit a user's page can exploit this to access the hash password of a user. This vulnerability is normally prevented on user profiles by default, except for users with Admin rights. It also impacts extensions that use passwords stored in xobjects, depending on the rights of those pages. There is no way to be 100% sure if this vulnerability has been exploited, as an attacker with enough privileges could have deleted the revision where the xobject was deleted after rolling back the deletion.

Recommendations For XWiki Platform versions 5.0-rc-1 through 14.10.18, upgrade to version 14.10.19 or later. For XWiki Platform versions 14.10.19 through 15.5.3, upgrade to version 15.5.4 or later. For XWiki Platform versions 15.5.4 through 15.9-rc-1, upgrade to version 15.9-rc-1 or later. As a temporary workaround, consider ensuring that user pages are properly protected by not allowing edit rights to other users than Admin and the owner of the profile. Change passwords on pages with a user password xobject that have in their history a revision where the object has been deleted.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-916

Related Identifiers

CVE-2024-31464

GHSA-V782-XR4W-3VQX

Affected Products

Xwiki Platform

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31464.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v782-xr4w-3vqx · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/f1eaec1e512220fabd970d053c627e435a1652cf · Patch
• https://github.com/xwiki/xwiki-platform/commit/9075668a4135cce114ef2a4b72eba3161a9e94c4 · Patch
• https://github.com/xwiki/xwiki-platform/commit/955fb097e02a2a7153f527522ee9eef42447e5d7 · Patch
• https://osv.dev/vulnerability/CVE-2024-31464 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v782-xr4w-3vqx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31464 · Security Note
• https://jira.xwiki.org/browse/XWIKI-19948 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/CVEnew/status/1778263655186055381 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1778164812733653281 · Twitter Post