CVE-2024-38369 | XWiki Platform is a generic wiki platform offering runtime s… | CVSS 10.0 CRITICAL

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using `{{include reference="targetdocument"/}}` is executed with the right of the includer and not with the right of its author. This means that any user able to modify the target document can impersonate the author of the content which used the `include` macro. This vulnerability has been patched in XWiki 15.0 RC1 by making the default behavior safe.

Metadata

CVE ID: CVE-2024-38369
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2024-06-14 14:16 UTC
Published: 2024-06-24 16:39 UTC
Last updated: 2024-08-02 04:04 UTC
Primary CWE: CWE-863
CWE-863: Incorrect Authorization
Vendor / Product: xwiki / xwiki-platform
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
xwiki	xwiki-platform	—	>= 1.5-milestone-2, < 15.0-rc-1

Weakness (CWE)

CWE	Source	Description
CWE-863	cna	CWE-863: Incorrect Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (1)

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qcj3-wpgm-qpxh https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qcj3-wpgm-qpxh