CVE-2024-41947

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 31, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-419485.0biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-419496.4biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-41952.7Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authent CVE-2024-419507.5Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. H CVE-2024-419514.4Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the m CVE-2024-419525.3Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which CVE-2024-419536.1Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamic CVE-2024-419547.8FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt CVE-2024-419555.4Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redire CVE-2024-419568.1Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repositor CVE-2024-419575.3Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding CVE-2024-419587.2mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentic