CVE-2024-43401: In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
Impact A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. Patches This vulnerability has been patched in XWiki 15.10RC1. Workarounds No workaround.
Published Aug 19, 2024 · Updated Aug 20, 2024
Affected packages
org.xwiki.platform:xwiki-platform-web-templates
- Ecosystem
- Maven
- Affected
- < 15.10-rc-1
- Fixed in
- 15.10-rc-1
- Check
mvn dependency:tree -Dincludes=org.xwiki.platform:xwiki-platform-web-templates
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time.
Patches
This vulnerability has been patched in XWiki 15.10RC1.
Workarounds
No workaround. It is advised to upgrade to XWiki 15.10+.
References
- https://jira.xwiki.org/browse/XWIKI-20331
- https://jira.xwiki.org/browse/XWIKI-21311
- https://jira.xwiki.org/browse/XWIKI-21481
- https://jira.xwiki.org/browse/XWIKI-21482
- https://jira.xwiki.org/browse/XWIKI-21483
- https://jira.xwiki.org/browse/XWIKI-21484
- https://jira.xwiki.org/browse/XWIKI-21485
- https://jira.xwiki.org/browse/XWIKI-21486
- https://jira.xwiki.org/browse/XWIKI-21487
- https://jira.xwiki.org/browse/XWIKI-21488
- https://jira.xwiki.org/browse/XWIKI-21489
- https://jira.xwiki.org/browse/XWIKI-21490
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at [Security Mailing List](mailto:[email protected])
Attribution
This vulnerability has been reported on Intigriti by @floerer
Credited to floerer.
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7
- https://nvd.nist.gov/vuln/detail/CVE-2024-43401
- https://jira.xwiki.org/browse/XWIKI-20331
- https://jira.xwiki.org/browse/XWIKI-21311
- https://jira.xwiki.org/browse/XWIKI-21481
- https://jira.xwiki.org/browse/XWIKI-21482
- https://jira.xwiki.org/browse/XWIKI-21483
- https://jira.xwiki.org/browse/XWIKI-21484
- https://jira.xwiki.org/browse/XWIKI-21485
- https://jira.xwiki.org/browse/XWIKI-21486
- https://jira.xwiki.org/browse/XWIKI-21487
- https://jira.xwiki.org/browse/XWIKI-21488
- https://jira.xwiki.org/browse/XWIKI-21489
- https://jira.xwiki.org/browse/XWIKI-21490
- https://github.com/advisories/GHSA-f963-4cq8-2gw7
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology