PT-2024-5617 · Xwiki · Xwiki Platform

Pierre Jeanjean · Published 2024-07-31 · Updated 2024-09-06 · CVE-2024-37898

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.10.21 XWiki Platform versions prior to 15.5.5 XWiki Platform versions prior to 15.10.6

Description The issue is related to a lack of authorization in the XWiki Platform, allowing a remote attacker to potentially execute arbitrary code. When a user has view but not edit rights on a page, they can delete the page and replace it with new content without having delete rights. The previous version of the page is moved into the recycle bin and can be restored by an admin. However, it does not seem possible to exploit this to gain any rights.

Recommendations For versions prior to 14.10.21, update to version 14.10.21 or later. For versions prior to 15.5.5, update to version 15.5.5 or later. For versions prior to 15.10.6, update to version 15.10.6 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-06311

CVE-2024-37898

GHSA-33GP-GMG3-HFPQ

Affected Products

Xwiki Platform

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37898.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-33gp-gmg3-hfpq · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/e4968fe268e5644ffd9bfa4ef6257d2796446009 · Patch
• https://github.com/xwiki/xwiki-platform/commit/56f5d8aab7371d5ba891168f73890806551322c5 · Patch
• https://github.com/xwiki/xwiki-platform/commit/0bc27d6ec63c8a505ff950e2d1792cb4f773c22e · Patch
• https://github.com/xwiki/xwiki-platform/commit/c5efc1e519e710afdf3c5f40c0fcc300ad77149f · Patch
• https://bdu.fstec.ru/vul/2024-06311 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37898 · Security Note
• https://osv.dev/vulnerability/GHSA-33gp-gmg3-hfpq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37898 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/88082 · Telegram Post
• https://t.me/cvenotify/88200 · Telegram Post
• https://t.me/cvedetector/2150 · Telegram Post
• https://jira.xwiki.org/browse/XWIKI-21553 · Note