CVE-2024-46978

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this. This vulnerability is present in XWiki since 13.2-rc-1. This vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters. Users are advised to upgrade. It's possible to fix manually the vulnerability by editing the document `XWiki.Notifications.Code.NotificationPreferenceService` to apply the changes performed in commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-648

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-469795.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to noti CVE-2024-46986.4The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slid CVE-2024-469804.8Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap E CVE-2024-469819.8Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulat CVE-2024-469827.5Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache CVE-2024-469839.8sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechani CVE-2024-469849.8The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The p CVE-2024-469857.5DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerabilit CVE-2024-469869.9Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible vi CVE-2024-469877.7Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via Media CVE-2024-469885.7Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap E CVE-2024-469895.3spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Mul