CVE-2024-43400 XWiki Platform allows XSS through XClass name in string properties

2024-08-1916:24:40

CWE-96

GitHub_M

www.cve.org

xwiki platform

xss

xclass

javascript

patched

url crafted

social engineering

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

21.8%

JSON

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.

CNA Affected

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 15.6-rc-1, < 15.10.2",
        "status": "affected"
      },
      {
        "version": ">= 15.0-rc-1, < 15.5.5",
        "status": "affected"
      },
      {
        "version": "< 14.10.21",
        "status": "affected"
      },
      {
        "version": "= 16.0.0-rc-1",
        "status": "affected"
      }
    ]
  }
]