PT-2024-32314 · Xwiki · Xwiki Platform

Bruhbey · Published 2024-09-18 · Updated 2024-09-20 · CVE-2024-46979

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 13.2-rc-1 through 14.10.20 XWiki Platform versions 15.0.0 through 15.5.4 XWiki Platform versions 15.10.0 XWiki Platform versions 16.0.0 before 16.0RC1

Description The issue allows access to notification filters of any user by using a URL such as <hostname>xwiki/bin/get/XWiki/Notifications/Code/NotificationFilterPreferenceLivetableResults?outputSyntax=plain&type=custom&user=<username>. The filters mainly contain references which are public data in XWiki, but some information could be used in combination with other vulnerabilities.

Recommendations For XWiki Platform versions 13.2-rc-1 through 14.10.20, upgrade to version 14.10.21 or later. For XWiki Platform versions 15.0.0 through 15.5.4, upgrade to version 15.5.5 or later. For XWiki Platform version 15.10.0, upgrade to version 15.10.1 or later. For XWiki Platform versions 16.0.0 before 16.0RC1, upgrade to version 16.0RC1 or later. As a temporary workaround, an administrator can edit directly the document XWiki.Notifications.Code.NotificationFilterPreferenceLivetableResults to apply the same changes as in the patch.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-359

CWE-200

Related Identifiers

CVE-2024-46979

GHSA-PG4M-3GP6-HW4W

Affected Products

Xwiki Platform

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46979.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pg4m-3gp6-hw4w · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/c8c6545f9bde6f5aade994aa5b5903a67b5c2582 · Patch
• https://osv.dev/vulnerability/CVE-2024-46979 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pg4m-3gp6-hw4w · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46979 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/ed090d1aa228848d3860968c437b72db3b09119f · Note
• https://github.com/xwiki/xwiki-platform/commit/29e5edbb2b7068ada17290cea41e0aa8144e1294 · Note
• https://github.com/xwiki/xwiki-platform/commit/a0352922a1a61e0e858a9be89d73f0665630a63a · Note
• https://t.me/cvedetector/6004 · Telegram Post
• https://twitter.com/CVEnew/status/1836534055745024457 · Twitter Post