QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2024-45591

Back to search

CVE-2024-45591

Published: Sep 10, 2024

Modified: Sep 10, 2024

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.

VendorProductVersions

xwiki

xwiki-platform

affected
>= 1.8.0, < 15.10.9
affected
>= 16.0.0-rc-1, < 16.3.0-rc-1

Weaknesses (CWE)

CWE-862
CWE-359

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now