CVE-2024-21648

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don't have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-274

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 1.0, < 14.10.17; >= 15.0-rc-1, < 15.5.3; >= 15.6-rc-1, < 15.8-rc-1

References

https://github.com/xwiki/xwiki-platform/commit/4de72875ca49602796165412741033bfdbf1e680Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xh35-w7wg-95v3Issue Tracking, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21257Issue Tracking, Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/4de72875ca49602796165412741033bfdbf1e680Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xh35-w7wg-95v3Issue Tracking, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21257Issue Tracking, Vendor Advisory

Timeline

Published: Jan 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-216498.8The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation CVE-2024-21655.4The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up CVE-2024-216509.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote cod CVE-2024-216516.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a p CVE-2024-216529.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can explo CVE-2024-216539.8The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation CVE-2024-216549.8Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeo CVE-2024-216554.3Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malici CVE-2024-216584.3discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on regi CVE-2024-21666.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time M CVE-2024-216617.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can explo CVE-2024-216629.1Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effec