CVE-2024-41947

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-41947

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41947.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-41947

Aliases

GHSA-692v-783f-mg8x

Published

2024-07-31T15:24:20Z

Modified

2025-11-07T17:17:16.190813Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

XWiki Platform XSS through conflict resolution

Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.

Database specific

{
    "cwe_ids": [
        "CWE-80"
    ]
}

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type: GIT
Repo: https://github.com/xwiki/xwiki-commons
Events: Introduced

4f2045d9c2db9a7cb240aa995071d416fce345b5

Fixed

63e05b1723e99d6914e6be23572cbb16affa6fd1

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type: GIT
Repo: https://github.com/xwiki/xwiki-platform
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

821d43ec45e67d45a6735a0717b9b77fffc1cd9f

Fixed

e00e159d3737397eebd1f6ff925c1f5cb7cdec34

Affected versions

xwiki-application-calendar-1.*

xwiki-application-calendar-1.0

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2

xwiki-platform-7.4-milestone-1

xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1

xwiki-platform-8.0-milestone-2

xwiki-platform-8.1-milestone-1

xwiki-platform-8.1-milestone-2

xwiki-platform-8.2-milestone-1

xwiki-platform-8.2-milestone-2

xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

xwiki-plugin-tag-1.*

xwiki-plugin-tag-1.1

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "21155742351908933010213828537043375122",
                "273166470439608780614388405906396775011",
                "257802522662050657643952040823402044512",
                "229476200234515363868841825713592731625",
                "248459148515579882089514317394450952605",
                "225805416268014336793980877945859740920",
                "3069364051456673488025796464750280495",
                "193224163244773286660232109753531851063",
                "288403268691264797168806873703562657529",
                "153420000428550045532760707455047246693",
                "227030252882608813056940215681387162889",
                "136434656779224626169361800611357890889",
                "158834344623340583666815344593027121470",
                "193224163244773286660232109753531851063",
                "1332571388758168851027022748764812579",
                "44905972275475979883088220851302570980",
                "78840683487569123086098334486816543326",
                "231642458328221174279473971436277455798",
                "171319635799392374080661634281621187601",
                "37375601237918814507296090296663130447"
            ]
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java"
        },
        "signature_version": "v1",
        "id": "CVE-2024-41947-2dd52f24",
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34"
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "21155742351908933010213828537043375122",
                "273166470439608780614388405906396775011",
                "257802522662050657643952040823402044512",
                "229476200234515363868841825713592731625",
                "248459148515579882089514317394450952605",
                "225805416268014336793980877945859740920",
                "3069364051456673488025796464750280495",
                "193224163244773286660232109753531851063",
                "288403268691264797168806873703562657529",
                "153420000428550045532760707455047246693",
                "227030252882608813056940215681387162889",
                "136434656779224626169361800611357890889",
                "158834344623340583666815344593027121470",
                "193224163244773286660232109753531851063",
                "1332571388758168851027022748764812579",
                "44905972275475979883088220851302570980",
                "78840683487569123086098334486816543326",
                "231642458328221174279473971436277455798",
                "171319635799392374080661634281621187601",
                "37375601237918814507296090296663130447"
            ]
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java"
        },
        "signature_version": "v1",
        "id": "CVE-2024-41947-4613ad70",
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "193954538563252037518932632250007806634",
            "length": 10868.0
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java",
            "function": "editWithConflict"
        },
        "signature_version": "v1",
        "id": "CVE-2024-41947-ceeb177d",
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "193954538563252037518932632250007806634",
            "length": 10868.0
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java",
            "function": "editWithConflict"
        },
        "signature_version": "v1",
        "id": "CVE-2024-41947-f82bc77e",
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34"
    }
]