Paper/Archive/CVE-2024-43401

CVE-2024-43401

xwiki xwiki-platform — In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

EPSS 0.7%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 52.3.523 × 2010.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.

Affected

ProductAffectedFixed inSource

xwiki-platform< 15.10-rc-1–CNA

xwiki-platform< 15.10-rc-115.10-rc-1CISA-ADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References