CVE-2024-43400

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-43400

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43400.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-43400

Aliases

GHSA-wcg9-pgqv-xm5v

Published

2024-08-19T16:24:40Z

Modified

2026-08-12T15:15:28Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

XWiki Platform allows XSS through XClass name in string properties

Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-96"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43400.json"
}

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type

GIT

Repo

https://github.com/xwiki/xwiki-commons

Events

Introduced

Fixed

c6cc6af0637c7e8f8be850fe4af66576934f8a53

Introduced

fdba4ca1398766e912f7888af5bdefbeef60d8b0

Fixed

5583e277218ab5de9930d969082a19ed0db4e472

Introduced

1e0e26611ad39442be884e876d902441a51fd34a

Fixed

5408ff53a61f0775cc5314a7ccde04c61c84caba

Database specific

Show details

{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "14.10.21"
        },
        {
            "introduced": "15.0"
        },
        {
            "fixed": "15.5.5"
        },
        {
            "introduced": "15.6"
        },
        {
            "fixed": "15.10.6"
        }
    ],
    "source": "CPE_RANGE"
}

Type

GIT

Repo

https://github.com/xwiki/xwiki-platform

Events

Introduced

Fixed

1bcc6e962dc5701ae6f9745a209a5c0c97461128

Introduced

96b4a230ee41ef74268c9720722f6473c705583d

Fixed

447f13c6b159cf0671b65c6be8f790cf046d7ada

Introduced

cb249a1a7570161ad6672449fbe89485fb489e95

Fixed

150468c1e2cd64a2ad85b5053e9487943d3b9b1f

Fixed

27eca8423fc1ad177518077a733076821268509c

Database specific

Show details

{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "14.10.21"
        },
        {
            "introduced": "15.0"
        },
        {
            "fixed": "15.5.5"
        },
        {
            "introduced": "15.6"
        },
        {
            "fixed": "15.10.6"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

= 16.*

= 16.0.0-rc-1

xwiki-commons-14.*

xwiki-commons-14.10

xwiki-commons-14.10.1

xwiki-commons-14.10.10

xwiki-commons-14.10.11

xwiki-commons-14.10.12

xwiki-commons-14.10.13

xwiki-commons-14.10.14

xwiki-commons-14.10.15

xwiki-commons-14.10.16

xwiki-commons-14.10.17

xwiki-commons-14.10.18

xwiki-commons-14.10.19

xwiki-commons-14.10.2

xwiki-commons-14.10.20

xwiki-commons-14.10.3

xwiki-commons-14.10.4

xwiki-commons-14.10.5

xwiki-commons-14.10.6

xwiki-commons-14.10.7

xwiki-commons-14.10.8

xwiki-commons-14.10.9

xwiki-commons-15.*

xwiki-commons-15.10

xwiki-commons-15.10-rc-1

xwiki-commons-15.10.1

xwiki-commons-15.10.2

xwiki-commons-15.10.3

xwiki-commons-15.10.4

xwiki-commons-15.10.5

xwiki-commons-15.5

xwiki-commons-15.5-rc-1

xwiki-commons-15.5.1

xwiki-commons-15.5.2

xwiki-commons-15.5.3

xwiki-commons-15.5.4

xwiki-commons-8.*

xwiki-commons-8.0-milestone-1

xwiki-commons-8.0-milestone-2

xwiki-commons-8.1-milestone-1

xwiki-commons-8.1-milestone-2

xwiki-commons-8.2-milestone-1

xwiki-commons-8.2-milestone-2

xwiki-commons-8.3-milestone-1

xwiki-commons-8.3-milestone-2

xwiki-platform-14.*

xwiki-platform-14.10

xwiki-platform-14.10.1

xwiki-platform-14.10.10

xwiki-platform-14.10.11

xwiki-platform-14.10.12

xwiki-platform-14.10.13

xwiki-platform-14.10.14

xwiki-platform-14.10.15

xwiki-platform-14.10.16

xwiki-platform-14.10.17

xwiki-platform-14.10.18

xwiki-platform-14.10.19

xwiki-platform-14.10.2

xwiki-platform-14.10.20

xwiki-platform-14.10.3

xwiki-platform-14.10.4

xwiki-platform-14.10.5

xwiki-platform-14.10.6

xwiki-platform-14.10.7

xwiki-platform-14.10.8

xwiki-platform-14.10.9

xwiki-platform-15.*

xwiki-platform-15.10

xwiki-platform-15.10-rc-1

xwiki-platform-15.10.1

xwiki-platform-15.10.2

xwiki-platform-15.10.3

xwiki-platform-15.10.4

xwiki-platform-15.10.5

xwiki-platform-15.5

xwiki-platform-15.5-rc-1

xwiki-platform-15.5.1

xwiki-platform-15.5.2

xwiki-platform-15.5.3

xwiki-platform-15.5.4

xwiki-platform-16.*

xwiki-platform-16.0.0-rc-1

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2

xwiki-platform-7.4-milestone-1

xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1

xwiki-platform-8.0-milestone-2

xwiki-platform-8.1-milestone-1

xwiki-platform-8.1-milestone-2

xwiki-platform-8.2-milestone-1

xwiki-platform-8.2-milestone-2

xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43400.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "44523286232865003206711423276447308424",
            "length": 1025
        },
        "id": "CVE-2024-43400-182fe193",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/StringClass.java",
            "function": "displayEdit"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "250210350337016613504990194401767809759",
                "81022745027328020218541956541465076802",
                "277089455802837876329505474539812530932",
                "10264008199618261152120864714454322495",
                "61967600956818476115245001605408020683",
                "267687967142196119638719841529487517654",
                "277029516981029085169378470242183948259",
                "198563120212623393066283799738553444453",
                "266398178995904076115118901183689764261",
                "74131165651961702893974221466117410856",
                "313231401384505902355826901341045556802",
                "144432212504479539061822411285177808403",
                "206990992398046408215187810023128335613",
                "295168326687055720225027019764988946804",
                "244271650478131134196491293915036271765",
                "171065788028851623193261153173967940545",
                "269398836738864210637576866897273889470",
                "330370400924928762398931438321845592889",
                "171991923339964778510958774603960784883",
                "144221576750534414025020802918583167612",
                "80702234498086116032930967971682940522",
                "98499692487043279032664618583717725289",
                "190281242013073237458062658982212828503",
                "318781784628591304205867891807767175809",
                "227902810019147919906990025031340049399",
                "123914879281998092751594126993658475242",
                "18339931596985506680971340450446273579",
                "81497573777431790572629694085290725523"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-43400-6b1458e5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/StringClass.java"
        }
    }
]

vanir_signatures_modified

"2026-08-12T15:15:28Z"