PT-2024-32313 · Xwiki · Xwiki Platform

Floerer · Published 2022-11-03 · Updated 2025-02-07 · CVE-2024-46978

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 13.2-rc-1 through 14.10.20 XWiki Platform versions 15.0.0 through 15.5.4 XWiki Platform versions 15.10.0

Description The issue allows any user knowing the ID of a notification filter preference of another user to enable, disable, or delete it. This could cause the target user to lose notifications on some pages. The patch for this issue involves checking the rights of the user before performing any action on the filters.

Recommendations For XWiki Platform versions 13.2-rc-1 through 14.10.20, upgrade to version 14.10.21 or later. For XWiki Platform versions 15.0.0 through 15.5.4, upgrade to version 15.5.5 or later. For XWiki Platform versions 15.10.0, upgrade to version 15.10.1 or later. As a temporary workaround, consider editing the document XWiki.Notifications.Code.NotificationPreferenceService to apply the changes performed in commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4.

Exploit

Fix

Weakness Enumeration

CWE-648

Related Identifiers

BDU:2025-03685

CVE-2024-46978

GHSA-R95W-889Q-X2GX

Affected Products

Xwiki Platform

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46978.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-46978 · Security Note
• https://bdu.fstec.ru/vul/2025-03685 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46978 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20337 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r95w-889q-x2gx · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/b9180b874a22e383ad5f2cd9e25bfed4594d4955 · Note
• https://github.com/xwiki/xwiki-platform/commit/4771573dac88e0cf04e30f1a8dfa183c048d503a · Note
• https://github.com/xwiki/xwiki-platform/commit/99193a7e9a203b5bb8b2583ac96f5f4d56b9aa1a · Note
• https://vuldb.com/?id.278109 · Note
• https://t.me/cvenotify/110401 · Telegram Post
• https://twitter.com/CVEnew/status/1836534054637666530 · Twitter Post