CVE-2024-45591

CVSS V2 None CVSS V3 None
Description
XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.
Overview
  • CVE ID
  • CVE-2024-45591
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-09-10T15:56:53.484Z
  • Last Modified Date
  • 2024-09-10T19:22:03.317Z
Weakness Enumerations
CWE URL
CWE-862 http://cwe.mitre.org/data/definitions/862.html
CWE-359 http://cwe.mitre.org/data/definitions/359.html
References
Reference URL Reference Tags
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm x_refsource_CONFIRM
https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f x_refsource_MISC
https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8 x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-22052 x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-45591
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45591
History
Created Old Value New Value Data Type Notes
2024-09-11 13:13:57 Added to TrackCVE