← Zuruck zu CVEs

CVE-2024-31996

CRITICAL

10.0

Beschreibung

XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool that is used in XWiki doesn't escape `{`, which, when used in certain places, allows XWiki syntax injection and thereby remote code execution. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9 RC1. Apart from upgrading, there is no generic workaround. However, replacing `$escapetool.html` by `$escapetool.xml` in XWiki documents fixes the vulnerability. In a standard XWiki installation, the maintainers are only aware of the document `Panels.PanelLayoutUpdate` that exposes this vulnerability, patching this document is thus a workaround. Any extension could expose this vulnerability and might thus require patching, too.

CVE Details

CVSS v3.1 Bewertung10.0

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht4/10/2024

Zuletzt geandert1/9/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

xwiki:xwiki

Schwachen (CWE)

CWE-95CWE-94

Referenzen

https://github.com/xwiki/xwiki-commons/commit/b0805160ec7b01ee12417e79cb384e60ae4817aa(security-advisories@github.com)

https://github.com/xwiki/xwiki-commons/commit/b94142e2a66ec32e89eacab67c3da8d91f5ef93a(security-advisories@github.com)

https://github.com/xwiki/xwiki-commons/commit/ed7ff515a2436a1c6dcbd0c6ca0c41e434d58915(security-advisories@github.com)

https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-hf43-47q4-fhq5(security-advisories@github.com)

https://jira.xwiki.org/browse/XCOMMONS-2828(security-advisories@github.com)

https://jira.xwiki.org/browse/XWIKI-21438(security-advisories@github.com)

https://github.com/xwiki/xwiki-commons/commit/b0805160ec7b01ee12417e79cb384e60ae4817aa(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/xwiki/xwiki-commons/commit/b94142e2a66ec32e89eacab67c3da8d91f5ef93a(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/xwiki/xwiki-commons/commit/ed7ff515a2436a1c6dcbd0c6ca0c41e434d58915(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-hf43-47q4-fhq5(af854a3a-2127-422b-91ae-364da2661108)

https://jira.xwiki.org/browse/XCOMMONS-2828(af854a3a-2127-422b-91ae-364da2661108)

https://jira.xwiki.org/browse/XWIKI-21438(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.