PT-2024-29654 · Unknown · Xwiki Platform

Michael Hamann · Published 2024-07-31 · Updated 2024-09-06 · CVE-2024-41947

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 15.10.8 XWiki Platform versions prior to 16.3.0RC1

Description The issue allows an attacker to execute JavaScript snippets on the side of another user, compromising the confidentiality, integrity, and availability of the whole XWiki installation. This can be achieved by creating a conflict when another user with more rights is currently editing a page. The estimated number of potentially affected devices is not specified.

To exploit this issue, a user with admin rights needs to edit a document without saving right away. Then, as another user without any other right than edit on the specific document, change the whole content to <script>alert('XSS')</script>. When the admin user then saves the document, a conflict popup appears. If they select "Fix each conflict individually" and see an alert displaying "XSS", then the instance is vulnerable.

Recommendations For XWiki Platform versions prior to 15.10.8, update to version 15.10.8 or later. For XWiki Platform versions prior to 16.3.0RC1, update to version 16.3.0RC1 or later. As a temporary workaround, consider restricting the ability to create conflicts when editing pages, until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2024-41947

GHSA-692V-783F-MG8X

Affected Products

Xwiki Platform

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41947.json · Exploit
• 🔥 https://exploit-db.com/exploits/52209 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-692v-783f-mg8x · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f · Patch
• https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34 · Patch
• https://jira.xwiki.org/browse/XWIKI-21626 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-692v-783f-mg8x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41947 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvedetector/2147 · Telegram Post
• https://t.me/cvenotify/88087 · Telegram Post
• https://t.me/cvenotify/88205 · Telegram Post
• https://t.me/cvenotify/93639 · Telegram Post