Vulnerability-Lookup

CVE-2024-43400 (GCVE-0-2024-43400)

Vulnerability from cvelistv5 – Published: 2024-08-19 16:24 – Updated: 2024-08-22 14:00

Title

XWiki Platform allows XSS through XClass name in string properties

Summary

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-19 17:17 UTC

CWE

CWE-96 - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/xwiki/xwiki-platform/security/…	x_refsource_CONFIRM
https://github.com/xwiki/xwiki-platform/commit/27…	x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-21810	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version	CPE status
xwiki	xwiki-platform	Affected: >= 15.6-rc-1, < 15.10.2 Affected: >= 15.0-rc-1, < 15.5.5 Affected: < 14.10.21 Affected: = 16.0.0-rc-1	guessed
xwiki	xwiki-platform	Affected: 15.6-rc-1 , < 15.10.2 (custom) Affected: 15.0-rc-1 , < 15.5.5 (custom) Affected: 0 , < 14.10.21 (custom) cpe:2.3:a:xwiki:xwiki-platform::::::::
xwiki	xwiki-platform	Affected: 16.0.0-rc-1 cpe:2.3:a:xwiki:xwiki-platform:16.0.0-rc-1:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xwiki-platform",
            "vendor": "xwiki",
            "versions": [
              {
                "lessThan": "15.10.2",
                "status": "affected",
                "version": "15.6-rc-1",
                "versionType": "custom"
              },
              {
                "lessThan": "15.5.5",
                "status": "affected",
                "version": "15.0-rc-1",
                "versionType": "custom"
              },
              {
                "lessThan": "14.10.21",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:xwiki:xwiki-platform:16.0.0-rc-1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xwiki-platform",
            "vendor": "xwiki",
            "versions": [
              {
                "status": "affected",
                "version": "16.0.0-rc-1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43400",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-19T17:17:50.141081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T14:00:37.297Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xwiki-platform",
          "vendor": "xwiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 15.6-rc-1, \u003c 15.10.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 15.0-rc-1, \u003c 15.5.5"
            },
            {
              "status": "affected",
              "version": "\u003c 14.10.21"
            },
            {
              "status": "affected",
              "version": "= 16.0.0-rc-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-96",
              "description": "CWE-96: Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-20T16:00:37.079Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v"
        },
        {
          "name": "https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21810",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21810"
        }
      ],
      "source": {
        "advisory": "GHSA-wcg9-pgqv-xm5v",
        "discovery": "UNKNOWN"
      },
      "title": "XWiki Platform allows XSS through XClass name in string properties"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-43400",
    "datePublished": "2024-08-19T16:24:40.900Z",
    "dateReserved": "2024-08-12T18:02:04.965Z",
    "dateUpdated": "2024-08-22T14:00:37.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43400",
      "date": "2026-11-08",
      "epss": "0.00488",
      "percentile": "0.42314"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "xwiki-platform",
                "vendor": "xwiki",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 15.6-rc-1, \u003c 15.10.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 15.0-rc-1, \u003c 15.5.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 14.10.21"
                  },
                  {
                    "status": "affected",
                    "version": "= 16.0.0-rc-1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "xwiki-platform",
                "vendor": "xwiki",
                "versions": [
                  {
                    "lessThan": "15.10.2",
                    "status": "affected",
                    "version": "15.6-rc-1",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "15.5.5",
                    "status": "affected",
                    "version": "15.0-rc-1",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "14.10.21",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:xwiki:xwiki-platform:16.0.0-rc-1:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "xwiki-platform",
                "vendor": "xwiki",
                "versions": [
                  {
                    "status": "affected",
                    "version": "16.0.0-rc-1"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC5486D1-904E-4848-9F2F-F1B23D0A5594",
                    "versionEndExcluding": "14.10.21",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CA7D00D6-D2DD-4678-A328-5C2A7E96FE48",
                    "versionEndExcluding": "15.5.5",
                    "versionStartIncluding": "15.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CCB0588B-7F74-423B-9D36-4B8E4F1BA459",
                    "versionEndExcluding": "15.10.6",
                    "versionStartIncluding": "15.6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0."
          },
          {
            "lang": "es",
            "value": "XWiki Platform es una plataforma wiki gen\u00e9rica que ofrece servicios de ejecuci\u00f3n para aplicaciones creadas sobre ella. Es posible que un usuario sin derechos de script o programaci\u00f3n cree una URL que apunte a una p\u00e1gina con JavaScript arbitrario. Esto requiere que un ingeniero social enga\u00f1e al usuario para que siga la URL. Esto ha sido parcheado en XWiki 14.10.21, 15.5.5, 15.10.6 y 16.0.0."
          }
        ],
        "id": "CVE-2024-43400",
        "lastModified": "2026-06-17T07:50:58.447",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 6.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-43400",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-19T17:17:50.141081Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-19T17:15:09.097",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://jira.xwiki.org/browse/XWIKI-21810"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-96"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:22:08+00:00",
      "cve": "CVE-2024-43400",
      "id": "CVE-2024-43400",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "XWiki Platform allows XSS through XClass name in string properties",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-43400.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "xwiki-platform",
                "vendor": "xwiki",
                "versions": [
                  {
                    "lessThan": "15.10.2",
                    "status": "affected",
                    "version": "15.6-rc-1",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "15.5.5",
                    "status": "affected",
                    "version": "15.0-rc-1",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "14.10.21",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:xwiki:xwiki-platform:16.0.0-rc-1:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "xwiki-platform",
                "vendor": "xwiki",
                "versions": [
                  {
                    "status": "affected",
                    "version": "16.0.0-rc-1"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-43400",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-08-19T17:17:50.141081Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-19T18:01:19.455Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "xwiki-platform",
              "vendor": "xwiki",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 15.6-rc-1, \u003c 15.10.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 15.0-rc-1, \u003c 15.5.5"
                },
                {
                  "status": "affected",
                  "version": "\u003c 14.10.21"
                },
                {
                  "status": "affected",
                  "version": "= 16.0.0-rc-1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-96",
                  "description": "CWE-96: Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-08-20T16:00:37.079Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c"
            },
            {
              "name": "https://jira.xwiki.org/browse/XWIKI-21810",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://jira.xwiki.org/browse/XWIKI-21810"
            }
          ],
          "source": {
            "advisory": "GHSA-wcg9-pgqv-xm5v",
            "discovery": "UNKNOWN"
          },
          "title": "XWiki Platform allows XSS through XClass name in string properties"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2024-43400",
        "datePublished": "2024-08-19T16:24:40.900Z",
        "dateReserved": "2024-08-12T18:02:04.965Z",
        "dateUpdated": "2024-08-22T14:00:37.297Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-43400

Vulnerability from fkie_nvd - Published: 2024-08-19 17:15 - Updated: 2026-06-17 07:50

Severity

9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c	Patch
security-advisories@github.com	https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v	Vendor Advisory
security-advisories@github.com	https://jira.xwiki.org/browse/XWIKI-21810	Issue Tracking, Vendor Advisory

Impacted products

Vendor	Product	Version
xwiki	xwiki	*
xwiki	xwiki	*
xwiki	xwiki	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "xwiki-platform",
          "vendor": "xwiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 15.6-rc-1, \u003c 15.10.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 15.0-rc-1, \u003c 15.5.5"
            },
            {
              "status": "affected",
              "version": "\u003c 14.10.21"
            },
            {
              "status": "affected",
              "version": "= 16.0.0-rc-1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "xwiki-platform",
          "vendor": "xwiki",
          "versions": [
            {
              "lessThan": "15.10.2",
              "status": "affected",
              "version": "15.6-rc-1",
              "versionType": "custom"
            },
            {
              "lessThan": "15.5.5",
              "status": "affected",
              "version": "15.0-rc-1",
              "versionType": "custom"
            },
            {
              "lessThan": "14.10.21",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:xwiki:xwiki-platform:16.0.0-rc-1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "xwiki-platform",
          "vendor": "xwiki",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0-rc-1"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC5486D1-904E-4848-9F2F-F1B23D0A5594",
              "versionEndExcluding": "14.10.21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA7D00D6-D2DD-4678-A328-5C2A7E96FE48",
              "versionEndExcluding": "15.5.5",
              "versionStartIncluding": "15.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCB0588B-7F74-423B-9D36-4B8E4F1BA459",
              "versionEndExcluding": "15.10.6",
              "versionStartIncluding": "15.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0."
    },
    {
      "lang": "es",
      "value": "XWiki Platform es una plataforma wiki gen\u00e9rica que ofrece servicios de ejecuci\u00f3n para aplicaciones creadas sobre ella. Es posible que un usuario sin derechos de script o programaci\u00f3n cree una URL que apunte a una p\u00e1gina con JavaScript arbitrario. Esto requiere que un ingeniero social enga\u00f1e al usuario para que siga la URL. Esto ha sido parcheado en XWiki 14.10.21, 15.5.5, 15.10.6 y 16.0.0."
    }
  ],
  "id": "CVE-2024-43400",
  "lastModified": "2026-06-17T07:50:58.447",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-43400",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-08-19T17:17:50.141081Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-08-19T17:15:09.097",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://jira.xwiki.org/browse/XWIKI-21810"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-96"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-WCG9-PGQV-XM5V

Vulnerability from github – Published: 2024-08-19 21:49 – Updated: 2024-08-19 21:49

Summary

XWiki Platform allows XSS through XClass name in string properties

Details

Impact

Is it possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL.

Reproduction steps

As a user without script or programming right, create a (non-terminal) document named " + alert(1) + " (the quotes need to be part of the name).
Edit the class.
Add a string property named "test".
Edit using the object editor and add an object of the created class
Get an admin to open <xwiki-server>/xwiki/bin/view/%22%20%2B%20alert(1)%20%2B%20%22/?viewer=display&type=object&property=%22%20%2B%20alert(1)%20%2B%20%22.WebHome.test&mode=edit where <xwiki-server> is the URL of your XWiki installation.

Patches

This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.

Workarounds

We're not aware of any workaround except upgrading.

References

https://jira.xwiki.org/browse/XWIKI-21810
https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c

Severity

9.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

9.4 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-oldcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.1.2"
            },
            {
              "fixed": "14.10.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-oldcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.0-rc-1"
            },
            {
              "fixed": "15.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-oldcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.6-rc-1"
            },
            {
              "fixed": "15.10.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-oldcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.0-rc-1"
            },
            {
              "fixed": "16.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "16.0.0-rc-1"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-43400"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-96"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-19T21:49:07Z",
    "nvd_published_at": "2024-08-19T17:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nIs it possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript.\nThis requires social engineer to trick a user to follow the URL.\n\n#### Reproduction steps\n\n1. As a user without script or programming right, create a (non-terminal) document named `\" + alert(1) + \"` (the quotes need to be part of the name).\n1. Edit the class.\n1. Add a string property named `\"test\"`.\n1. Edit using the object editor and add an object of the created class\n1. Get an admin to open `\u003cxwiki-server\u003e/xwiki/bin/view/%22%20%2B%20alert(1)%20%2B%20%22/?viewer=display\u0026type=object\u0026property=%22%20%2B%20alert(1)%20%2B%20%22.WebHome.test\u0026mode=edit` where `\u003cxwiki-server\u003e` is the URL of your XWiki installation.\n\n### Patches\nThis has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.\n\n### Workarounds\n\nWe\u0027re not aware of any workaround except upgrading.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-21810\n- https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c\n",
  "id": "GHSA-wcg9-pgqv-xm5v",
  "modified": "2024-08-19T21:49:07Z",
  "published": "2024-08-19T21:49:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43400"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21810"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "XWiki Platform allows XSS through XClass name in string properties"
}

WID-SEC-W-2024-1880

Vulnerability from csaf_certbund - Published: 2024-08-19 22:00 - Updated: 2024-08-19 22:00

Summary

xwiki: Mehrere Schwachstellen

Severity

Hoch

Scope

2 vulnerabilities in this advisory, including CVE-2024-43400.

CVE-2024-43400

In xwiki existiert eine Cross-Site Scripting Schwachstelle. HTML und Script-Eingaben werden nicht ordnungsgemäß überprüft, bevor sie an den Benutzer zurückgegeben werden. Ein entfernter, authentisierter Angreifer kann durch Ausnutzung dieser Schwachstelle beliebigen HTML- und Script-Code durch den Browser des Benutzers im Kontext der betroffenen Seite ausführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-43400 (GCVE-0-2024-43400)

FKIE_CVE-2024-43400

GHSA-WCG9-PGQV-XM5V

Impact

Reproduction steps

Patches

Workarounds

References

WID-SEC-W-2024-1880

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour