PT-2024-31551 · Wiki.Js · Wiki.Js

Urda · Published 2024-09-18 · Updated 2024-09-20 · CVE-2024-45298

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wiki.js version 2.5.303

Description A disabled user can still gain access to a wiki by abusing the password reset function. This allows a user to bypass an account disabling by requesting their password be reset. The issue has been addressed in version 2.5.304.

Recommendations For Wiki.js version 2.5.303, upgrade to version 2.5.304 to resolve the issue. As a temporary workaround, consider disabling the password reset function until the upgrade is applied. Restrict access to the wiki for disabled users to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2024-45298

GHSA-VWWW-C5VG-XGFC

Affected Products

Wiki.Js

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45298.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45298 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45298 · Vendor Advisory
• https://github.com/requarks/wiki/security/advisories/GHSA-vwww-c5vg-xgfc · Note
• https://github.com/requarks/wiki/commit/b9fb17d4d4a0956ec35e8c73cc85192552fb8d16 · Note
• https://t.me/cvedetector/6003 · Telegram Post
• https://t.me/cvenotify/95121 · Telegram Post
• https://twitter.com/CVEnew/status/1836534059423383762 · Twitter Post