PT-2024-27963 · Xwiki · Xwiki Platform

Tmortagne · Published 2024-06-24 · Updated 2024-06-26 · CVE-2024-38369

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 15.0 RC1

Description The content of a document included using {{include reference="targetdocument"/}} is executed with the rights of the includer and not with the rights of its author. This means that any user able to modify the target document can impersonate the author of the content which used the include macro.

Recommendations For versions prior to 15.0 RC1, make sure to protect any included document to ensure only allowed users can modify it. A workaround is available in 14.10.2 to allow forcing the execution of the included content with the target content author instead of the default behavior. Update to XWiki 15.0 RC1 or later, where the default behavior has been made safe.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-38369

GHSA-QCJ3-WPGM-QPXH

Affected Products

Xwiki Platform

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38369.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qcj3-wpgm-qpxh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38369 · Security Note
• https://osv.dev/vulnerability/GHSA-qcj3-wpgm-qpxh · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/d1a84a3eea38305ff8e10ba411910c0675ac157c · Note
• https://github.com/xwiki/xwiki-platform/commit/f627abe2dc39b07ff75fe68398cc8a1bbc743ef7 · Note
• https://github.com/xwiki/xwiki-platform/commit/c1fb14402ce2ee569c5a8e3f1f8e64ae45dfbfb0 · Note
• https://github.com/xwiki/xwiki-platform/commit/b48116a3ebe9ce928c401b5d068d4db7e7239575 · Note
• https://github.com/xwiki/xwiki-platform/commit/0a4f9b026ba9931516b4e9b3019da8da838c7ac6 · Note
• https://t.me/cvenotify/84201 · Telegram Post
• https://jira.xwiki.org/browse/XWIKI-20471 · Note
• https://jira.xwiki.org/browse/XWIKI-5027 · Note
• https://t.me/cvenotify/84495 · Telegram Post