This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] XWiki fixes 5 vulnerabilities
XWiki fixes 5 vulnerabilities, 3 of them critical. Fixes can be found in the links next to the individual vulnerabilities.
Allows an authenticated remote attacker to impersonate the author of content that used the 'include' macro [1].
The vulnerability is present in product:
- xwiki-platform; >=1.5-milestone-2, <15.0-rc-1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-38369 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 24. 6. 2024.
Allows an authenticated remote attacker with edit rights on any page to achieve arbitrary remote code execution by adding instances of 'XWiki.SearchSuggestConfig' and 'XWiki.SearchSuggestSourceClass' to their user profile or another page [2].
The vulnerability is present in product:
- xwiki-platform; >=15.6-rc-1, <15.10.2; >=15.0-rc-1, <15.5.5; >=9.2-rc-1, <14.10.21;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-37901 at cve.org, NVD
- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code at cwe.mitre.org
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 31. 7. 2024.
Allows an authenticated remote attacker to execute JavaScript fragments in the context of another user [3].
The vulnerability is present in product:
- xwiki-platform; >=11.8-rc-1, <15.10.8; >=16.0.0-rc-1, <16.3.0-rc-1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
More information:
- CVE-2024-41947 at cve.org, NVD
- CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page at cwe.mitre.org
The vulnerability was publicly disclosed 31. 7. 2024.
Allows an authenticated remote attacker to execute malicious JavaScript code [4].
The vulnerability is present in product:
- xwiki-platform; >=4.2-milestone-3, <14.10.21; >=15.0-rc-1, <15.5.5; >=15.6-rc-1, <15.10.6; >=16.0.0-rc-1, <16.0.0
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
More information:
- CVE-2024-37900 at cve.org, NVD
- CWE-96: Improper Neutralization of Directives in Statically Saved Code at cwe.mitre.org
The vulnerability was publicly disclosed 31. 7. 2024.
Allows an authenticated remote attacker with permission to view, but not edit, a page in XWiki to delete the page and replace it with new content [5].
The vulnerability is present in product:
- xwiki-platform; >=13.10.4, <14.0-rc-1; >=14.2, <14.10.21; >=15.0, <15.5.5; >=15.6-rc-1, <15.10.6
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
More information:
- CVE-2024-37898 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 31. 7. 2024.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 5. 8. 2024.