github - ghsa-f963-4cq8-2gw7

ghsa-f963-4cq8-2gw7

Vulnerability from github

Published

2024-08-19 21:49

Modified

2024-08-19 21:49

Severity ?

9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Summary

In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

Details

Impact

A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time.

Patches

This vulnerability has been patched in XWiki 15.10RC1.

Workarounds

No workaround. It is advised to upgrade to XWiki 15.10+.

References

https://jira.xwiki.org/browse/XWIKI-20331
https://jira.xwiki.org/browse/XWIKI-21311
https://jira.xwiki.org/browse/XWIKI-21481
https://jira.xwiki.org/browse/XWIKI-21482
https://jira.xwiki.org/browse/XWIKI-21483
https://jira.xwiki.org/browse/XWIKI-21484
https://jira.xwiki.org/browse/XWIKI-21485
https://jira.xwiki.org/browse/XWIKI-21486
https://jira.xwiki.org/browse/XWIKI-21487
https://jira.xwiki.org/browse/XWIKI-21488
https://jira.xwiki.org/browse/XWIKI-21489
https://jira.xwiki.org/browse/XWIKI-21490

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List

Attribution

This vulnerability has been reported on Intigriti by @floerer

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-web-templates"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.10-rc-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-43401"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-19T21:49:15Z",
    "nvd_published_at": "2024-08-19T17:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nA user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor.\nThe user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content.\nThe payload is executed at edit time.\n\n### Patches\n\nThis vulnerability has been patched in XWiki 15.10RC1.\n\n### Workarounds\n\nNo workaround. It is advised to upgrade to XWiki 15.10+.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-20331\n* https://jira.xwiki.org/browse/XWIKI-21311\n* https://jira.xwiki.org/browse/XWIKI-21481\n* https://jira.xwiki.org/browse/XWIKI-21482\n* https://jira.xwiki.org/browse/XWIKI-21483\n* https://jira.xwiki.org/browse/XWIKI-21484\n* https://jira.xwiki.org/browse/XWIKI-21485\n* https://jira.xwiki.org/browse/XWIKI-21486\n* https://jira.xwiki.org/browse/XWIKI-21487\n* https://jira.xwiki.org/browse/XWIKI-21488\n* https://jira.xwiki.org/browse/XWIKI-21489\n* https://jira.xwiki.org/browse/XWIKI-21490\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThis vulnerability has been reported on Intigriti by @floerer",
  "id": "GHSA-f963-4cq8-2gw7",
  "modified": "2024-08-19T21:49:15Z",
  "published": "2024-08-19T21:49:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43401"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-20331"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21311"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21481"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21482"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21483"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21484"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21485"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21486"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21487"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21488"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21489"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21490"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them"
}

cve-2024-43401

Vulnerability from cvelistv5

Published

2024-08-19 16:24

Modified

2024-08-21 14:23

Severity ?

9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Summary

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.

References

▼	URL	Tags
	https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7	x_refsource_CONFIRM
	https://jira.xwiki.org/browse/XWIKI-20331	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21311	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21481	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21482	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21483	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21484	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21485	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21486	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21487	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21488	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21489	x_refsource_MISC
	https://jira.xwiki.org/browse/XWIKI-21490	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

xwiki

xwiki-platform

Version: < 15.10-rc-1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xwiki-platform",
            "vendor": "xwiki",
            "versions": [
              {
                "lessThan": "15.10-rc-1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-21T14:22:37.541699Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T14:23:29.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xwiki-platform",
          "vendor": "xwiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 15.10-rc-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-19T16:24:29.698Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-20331",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-20331"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21311",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21311"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21481",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21481"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21482",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21482"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21483",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21483"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21484",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21484"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21485",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21485"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21486",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21486"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21487",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21487"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21488",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21488"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21489",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21489"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-21490",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-21490"
        }
      ],
      "source": {
        "advisory": "GHSA-f963-4cq8-2gw7",
        "discovery": "UNKNOWN"
      },
      "title": "In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-43401",
    "datePublished": "2024-08-19T16:24:29.698Z",
    "dateReserved": "2024-08-12T18:02:04.965Z",
    "dateUpdated": "2024-08-21T14:23:29.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-f963-4cq8-2gw7

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

Attribution

cve-2024-43401

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature