fkie_cve-2024-55876
Vulnerability from fkie_nvd
Published
2024-12-12 19:15
Modified
2024-12-13 15:15
Severity ?
Summary
XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch."
},
{
"lang": "es",
"value": "XWiki Platform es una plataforma wiki gen\u00e9rica. A partir de la versi\u00f3n 1.2-milestone-2 y antes de las versiones 15.10.9 y 16.3.0, cualquier usuario con una cuenta en la wiki principal pod\u00eda ejecutar operaciones de programaci\u00f3n en subwikis. Para reproducir, como usuario de la wiki principal sin ning\u00fan derecho especial, visualice el documento `Scheduler.WebHome` en una subwiki. Luego, haga clic en cualquier operaci\u00f3n (*por ejemplo,* Trigger) en cualquier trabajo. Si la operaci\u00f3n es exitosa, entonces la instancia es vulnerable. Esto ha sido corregido en XWiki 15.10.9 y 16.3.0. Como workaround, aquellos que tienen subwikis donde el Programador de trabajos est\u00e1 habilitado pueden editar los objetos en `Scheduler.WebPreferences` para que coincidan con el parche."
}
],
"id": "CVE-2024-55876",
"lastModified": "2024-12-13T15:15:42.960",
"metrics": {
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2024-12-12T19:15:14.140",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6"
},
{
"source": "security-advisories@github.com",
"url": "https://jira.xwiki.org/browse/XWIKI-21663"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://jira.xwiki.org/browse/XWIKI-21663"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.