GitHub_MCVELIST:CVE-2024-21648CVE-2024-21648 XWiki has no right protection on rollback action
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
9.1 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
27.3%
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don’t have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.
CNA Affected
[
{
"vendor": "xwiki",
"product": "xwiki-platform",
"versions": [
{
"version": ">= 1.0, < 14.10.17",
"status": "affected"
},
{
"version": ">= 15.0-rc-1, < 15.5.3",
"status": "affected"
},
{
"version": ">= 15.6-rc-1, < 15.8-rc-1",
"status": "affected"
}
]
}
]Related
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
9.1 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
27.3%