CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 0CVE-2024-31981 – XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
https://notcve.org/view.php?id=CVE-2024-31981
XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, remote code execution is possible via PDF export templates. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10-rc-1. If PDF templates are not typically used on the instance, an administrator can create the document `XWiki.PDFClass` and block its edition, after making sure that it does not contain a `style` attribute. Otherwise, there are no known workarounds aside from upgrading. • https://github.com/xwiki/xwiki-platform/commit/480186f9d2fca880513da8bc5a609674d106cbd3 https://github.com/xwiki/xwiki-platform/commit/a4ad14d9c1605a5ab957237e505ebbb29f5b9d73 https://github.com/xwiki/xwiki-platform/commit/d28e21a670c69880b951e415dd2ddd69d273eae9 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxwr-wpjv-qjq7 https://jira.xwiki.org/browse/XWIKI-21337 • CWE-862: Missing Authorization •
CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 0CVE-2024-31465 – XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
https://notcve.org/view.php?id=CVE-2024-31465
XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the document `XWiki.SearchSuggestSourceSheet`. • https://github.com/xwiki/xwiki-platform/commit/0317a3aa78065e66c86fc725976b06bf7f9b446e https://github.com/xwiki/xwiki-platform/commit/2740974c32dbb7cc565546d0f04e2374b32b36f7 https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809 https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809#diff-67b473d2b6397d65b7726c6a13555850b11b10128321adf9e627e656e1d130a5 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-34fj-r5gq-7395 https://jira.xwiki.org/browse/XWIKI-21474 • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-31464 – XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted
https://notcve.org/view.php?id=CVE-2024-31464
XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the hash of a password by using the diff feature of the history whenever the object storing the password is deleted. Using that vulnerability it's possible for an attacker to have access to the hash password of a user if they have rights to edit the users' page. With the default right scheme in XWiki this vulnerability is normally prevented on user profiles, except by users with Admin rights. Note that this vulnerability also impacts any extensions that might use passwords stored in xobjects: for those usecases it depends on the right of those pages. • https://github.com/xwiki/xwiki-platform/commit/9075668a4135cce114ef2a4b72eba3161a9e94c4 https://github.com/xwiki/xwiki-platform/commit/955fb097e02a2a7153f527522ee9eef42447e5d7 https://github.com/xwiki/xwiki-platform/commit/f1eaec1e512220fabd970d053c627e435a1652cf https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v782-xr4w-3vqx https://jira.xwiki.org/browse/XWIKI-19948 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-21648 – XWiki has no right protection on rollback action
https://notcve.org/view.php?id=CVE-2024-21648
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don't have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback. XWiki Platform es una plataforma wiki genérica que ofrece servicios de ejecución para aplicaciones creadas sobre ella. A la acción de reversión le falta una protección adecuada, un usuario puede retroceder a una versión anterior de la página para obtener derechos que ya no tiene. • https://github.com/xwiki/xwiki-platform/commit/4de72875ca49602796165412741033bfdbf1e680 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xh35-w7wg-95v3 https://jira.xwiki.org/browse/XWIKI-21257 • CWE-274: Improper Handling of Insufficient Privileges •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-21651 – XWiki Denial of Service attack through attachments
https://notcve.org/view.php?id=CVE-2024-21651
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1. XWiki Platform es una plataforma wiki genérica que ofrece servicios de ejecución para aplicaciones creadas sobre ella. Un usuario capaz de adjuntar un archivo a una página puede publicar un archivo TAR con formato incorrecto manipulando los encabezados de los tiempos de modificación del archivo, que cuando Tika los analiza, podría causar un problema de denegación de servicio debido al consumo de CPU. • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8959-rfxh-r4j4 https://jira.xwiki.org/browse/XCOMMONS-2796 • CWE-400: Uncontrolled Resource Consumption •