PT-2024-31694 · Unknown · Xwiki Platform

Xiqinger · Published 2024-09-10 · Updated 2025-10-20 · CVE-2024-45591

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 15.10.9 XWiki versions prior to 16.3.0RC1

Description The XWiki Platform, a generic wiki platform, has an issue where its REST API exposes the history of any page if an attacker knows the page name. The exposed information includes the time of modification, version number, author (username and displayed name), and version comment for each page modification. This disclosure occurs regardless of permission settings, even on fully private wikis. The issue can be tested by accessing the /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history API endpoint. If the history of the main page is displayed, the installation is affected.

Recommendations For XWiki versions prior to 15.10.9, upgrade to version 15.10.9 or later. For XWiki versions prior to 16.3.0RC1, upgrade to version 16.3.0RC1 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-359

Related Identifiers

CVE-2024-45591

GHSA-PVMM-55R5-G3MM

Affected Products

Xwiki Platform

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45591.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-22052 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8 · Patch
• https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f · Patch
• https://osv.dev/vulnerability/GHSA-pvmm-55r5-g3mm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45591 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/CVEnew/status/1833549062236475619 · Twitter Post
• https://t.me/CSIRT_italia/2818 · Telegram Post
• https://t.me/cvenotify/95538 · Telegram Post
• https://t.me/cvedetector/5263 · Telegram Post