CVE-2024-43401

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269 CWE-862

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	< 15.10-rc-1
xwiki	xwiki-platform	< 15.10-rc-1

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20331Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21311Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21481Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21482Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21483Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21484Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21485Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21486Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21487Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21488Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21489Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-21490Issue Tracking, Vendor Advisory

Timeline

Published: Aug 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-434028.8Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch CVE-2024-434038.8Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with CVE-2024-434049.8MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a CVE-2024-434057.8Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in CVE-2024-434068.8LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could u CVE-2024-434076.1CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snipp CVE-2024-434086.3Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post CVE-2024-434096.5Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to p CVE-2024-43416.5Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in ExtremePacs Extreme XDS allows Collect Data as Prov CVE-2024-434107.5Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server.CVE-2024-434113.1CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and CVE-2024-434125.4Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting v