fkie_cve-2024-37898
Vulnerability from fkie_nvd
Published
2024-07-31 16:15
Modified
2024-09-06 21:16
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in XWiki, that user can delete the page and replace it by a page with new content without having delete right. The previous version of the page is moved into the recycle bin and can be restored from there by an admin. As the user is recorded as deleter, the user would in theory also be able to view the deleted content, but this is not directly possible as rights of the previous version are transferred to the new page and thus the user still doesn't have view right on the page. It therefore doesn't seem to be possible to exploit this to gain any rights. This has been patched in XWiki 14.10.21, 15.5.5 and 15.10.6 by cancelling save operations by users when a new document shall be saved despite the document's existing already.
References
security-advisories@github.comhttps://github.com/xwiki/xwiki-platform/commit/0bc27d6ec63c8a505ff950e2d1792cb4f773c22ePatch
security-advisories@github.comhttps://github.com/xwiki/xwiki-platform/commit/56f5d8aab7371d5ba891168f73890806551322c5Patch
security-advisories@github.comhttps://github.com/xwiki/xwiki-platform/commit/c5efc1e519e710afdf3c5f40c0fcc300ad77149fPatch
security-advisories@github.comhttps://github.com/xwiki/xwiki-platform/commit/e4968fe268e5644ffd9bfa4ef6257d2796446009Patch
security-advisories@github.comhttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-33gp-gmg3-hfpqVendor Advisory
security-advisories@github.comhttps://jira.xwiki.org/browse/XWIKI-21553Issue Tracking
Impacted products
Vendor Product Version
xwiki xwiki *
xwiki xwiki *
xwiki xwiki *
xwiki xwiki *
xwiki xwiki 15.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5E22F870-1104-4229-BDCD-60B6914D2631",
                     versionEndExcluding: "14.0",
                     versionStartIncluding: "13.10.4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "55A6EBA5-A890-4FBB-819D-BE929110EDCA",
                     versionEndExcluding: "14.10.21",
                     versionStartIncluding: "14.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0898991F-3E04-465E-8937-AC929C27ED90",
                     versionEndExcluding: "15.5.5",
                     versionStartExcluding: "15.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CCB0588B-7F74-423B-9D36-4B8E4F1BA459",
                     versionEndExcluding: "15.10.6",
                     versionStartIncluding: "15.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*",
                     matchCriteriaId: "99329652-2907-4903-AAB1-1038F225C020",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in XWiki, that user can delete the page and replace it by a page with new content without having delete right. The previous version of the page is moved into the recycle bin and can be restored from there by an admin. As the user is recorded as deleter, the user would in theory also be able to view the deleted content, but this is not directly possible as rights of the previous version are transferred to the new page and thus the user still doesn't have view right on the page. It therefore doesn't seem to be possible to exploit this to gain any rights. This has been patched in XWiki 14.10.21, 15.5.5 and 15.10.6 by cancelling save operations by users when a new document shall be saved despite the document's existing already.",
      },
      {
         lang: "es",
         value: "XWiki Platform es una plataforma wiki genérica que ofrece servicios de ejecución para aplicaciones creadas sobre ella. Cuando un usuario tiene derecho de ver pero no de editar en una página en XWiki, ese usuario puede eliminar la página y reemplazarla por una página con contenido nuevo sin tener derecho de eliminación. La versión anterior de la página se mueve a la papelera de reciclaje y un administrador puede restaurarla desde allí. Como el usuario está registrado como eliminador, en teoría el usuario también podría ver el contenido eliminado, pero esto no es directamente posible ya que los derechos de la versión anterior se transfieren a la nueva página y, por lo tanto, el usuario aún no puede verlo. justo en la página. Por lo tanto, no parece posible explotar esto para obtener ningún derecho. Esto se ha parcheado en XWiki 14.10.21, 15.5.5 y 15.10.6 cancelando las operaciones de guardado por parte de los usuarios cuando se guarda un nuevo documento a pesar de que ya existe.",
      },
   ],
   id: "CVE-2024-37898",
   lastModified: "2024-09-06T21:16:55.600",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 1.4,
            source: "security-advisories@github.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-07-31T16:15:03.197",
   references: [
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
         ],
         url: "https://github.com/xwiki/xwiki-platform/commit/0bc27d6ec63c8a505ff950e2d1792cb4f773c22e",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
         ],
         url: "https://github.com/xwiki/xwiki-platform/commit/56f5d8aab7371d5ba891168f73890806551322c5",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
         ],
         url: "https://github.com/xwiki/xwiki-platform/commit/c5efc1e519e710afdf3c5f40c0fcc300ad77149f",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
         ],
         url: "https://github.com/xwiki/xwiki-platform/commit/e4968fe268e5644ffd9bfa4ef6257d2796446009",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-33gp-gmg3-hfpq",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Issue Tracking",
         ],
         url: "https://jira.xwiki.org/browse/XWIKI-21553",
      },
   ],
   sourceIdentifier: "security-advisories@github.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-862",
            },
         ],
         source: "security-advisories@github.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-862",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.