This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] XWiki fixes 2 vulnerabilities

XWiki fixes 2 vulnerabilities in version 15.10.6 [1][2].

XWiki - execution of payload in editor (CVE-2024-43401)
CVSS 9.0 (Critical)

An authenticated remote attacker can, using social engineering, execute code on the victim of the attack [2].

The vulnerability is present in product:

  • XWiki; <15.10-rc-1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 19. 8. 2024.

XWiki - XSS (CVE-2024-43400)
CVSS 9.0 (Critical)

An authenticated remote attacker can, using social engineering, carry out an XSS attack [1].

The vulnerability is present in product:

  • XWiki; <1.1.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

More information:

  • CVE-2024-43400 at cve.org, NVD
  • CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 19. 8. 2024.

By CESNET, z.s.p.o. Martin Krajči on 20. 8. 2024.

CESNET, z.s.p.o. Logo