CVE-2024-45591

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-45591

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45591.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-45591

Aliases

GHSA-pvmm-55r5-g3mm

Published

2024-09-10T15:56:53.484Z

Modified

2026-08-12T15:15:33.683534Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

XWiki Platform document history including authors of any page exposed to unauthorized actors

Details

XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-359",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45591.json"
}

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type

GIT

Repo

https://github.com/xwiki/xwiki-commons

Events

Introduced

10aac24eea2647c0e044176c369755baf8c5a5f1

Fixed

3f100aee4c197e68d2986717a878d0bbd4fb0c22

Introduced

918ea43fe0d277c28efa21a871175b329c75157c

Fixed

ed06afe4614a2782ddac6e42ed21f180056a206e

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.8"
        },
        {
            "fixed": "15.10.9"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.3.0"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"
}

Type

GIT

Repo

https://github.com/xwiki/xwiki-platform

Events

Introduced

943ce46958cb17adcf82e8fa381fb36616646f0b

Fixed

1c4b9ba5f04cd8d636a6718465a0b8e251f51420

Introduced

3c6f5cf138d8095f63631e554ba448e4b780e162

Fixed

50fb1f191827504c6173697d6c39aa093301a851

Fixed

26482ee5d29fc21f31134d1ee13db48716e89e0f

Fixed

9cbca9808300797c67779bb9a665d85cf9e3d4b8

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.8"
        },
        {
            "fixed": "15.10.9"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.3.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45591.json"

vanir_signatures

[
    {
        "target": {
            "function": "getPageTranslationHistory",
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f",
        "id": "CVE-2024-45591-0e7ad348",
        "signature_version": "v1",
        "digest": {
            "length": 1421.0,
            "function_hash": "288475750190715031284230817422013311144"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "getPageHistory",
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f",
        "id": "CVE-2024-45591-770dc1ad",
        "signature_version": "v1",
        "digest": {
            "length": 1391.0,
            "function_hash": "308361931181380220859253464077646852597"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "getPageHistory",
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8",
        "id": "CVE-2024-45591-89aa7506",
        "signature_version": "v1",
        "digest": {
            "length": 1391.0,
            "function_hash": "308361931181380220859253464077646852597"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8",
        "id": "CVE-2024-45591-ab3aa6cd",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "3040236606649621333377421367846740581",
                "124761170461509244545270863193178880832",
                "168078324775925323646511532571686813552",
                "177779699407833604672352283748281317230",
                "108911551660315955580511635272232778424",
                "292073498605713314552312496184590363330",
                "22772543593571939177495608406649351170",
                "268046476405665234545111053989912068098",
                "285602288944094074055009975546446072534",
                "147170873860239309388372509952432288515",
                "13275910919432188171641581003966317601",
                "156503891472406369870966731551636736622",
                "201624936566598416179643849206898656511",
                "36507558003979839350355750298506800583",
                "126494544728243324795114897360729489429",
                "106182330578261922465410442201295882259",
                "328619401425764327412398246037401280928",
                "189770970410034781833166921717845264808"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8",
        "id": "CVE-2024-45591-ab76d70e",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "3040236606649621333377421367846740581",
                "124761170461509244545270863193178880832",
                "168078324775925323646511532571686813552",
                "177779699407833604672352283748281317230",
                "108911551660315955580511635272232778424",
                "165204978348614368254239538202378841577",
                "214592701342727098019962265405349190137",
                "29932313973199257229427411065157382442",
                "32611891693385186983493132068205749356",
                "30218208481750828242496099718341114654",
                "162803263138568120545131874020830083568",
                "171821600779831736144197423289092474836",
                "148840285311347729292565946799325704984",
                "25381539997341389054568704540019226704",
                "196949271056384777673118191462390786624",
                "189300672521638578620700962368824447204",
                "328619401425764327412398246037401280928",
                "189770970410034781833166921717845264808"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f",
        "id": "CVE-2024-45591-bd618136",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "3040236606649621333377421367846740581",
                "124761170461509244545270863193178880832",
                "168078324775925323646511532571686813552",
                "177779699407833604672352283748281317230",
                "108911551660315955580511635272232778424",
                "165204978348614368254239538202378841577",
                "214592701342727098019962265405349190137",
                "29932313973199257229427411065157382442",
                "32611891693385186983493132068205749356",
                "30218208481750828242496099718341114654",
                "162803263138568120545131874020830083568",
                "171821600779831736144197423289092474836",
                "148840285311347729292565946799325704984",
                "25381539997341389054568704540019226704",
                "196949271056384777673118191462390786624",
                "189300672521638578620700962368824447204",
                "328619401425764327412398246037401280928",
                "189770970410034781833166921717845264808"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f",
        "id": "CVE-2024-45591-c007aea0",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "3040236606649621333377421367846740581",
                "124761170461509244545270863193178880832",
                "168078324775925323646511532571686813552",
                "177779699407833604672352283748281317230",
                "108911551660315955580511635272232778424",
                "292073498605713314552312496184590363330",
                "22772543593571939177495608406649351170",
                "268046476405665234545111053989912068098",
                "285602288944094074055009975546446072534",
                "147170873860239309388372509952432288515",
                "13275910919432188171641581003966317601",
                "156503891472406369870966731551636736622",
                "201624936566598416179643849206898656511",
                "36507558003979839350355750298506800583",
                "126494544728243324795114897360729489429",
                "106182330578261922465410442201295882259",
                "328619401425764327412398246037401280928",
                "189770970410034781833166921717845264808"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "getPageTranslationHistory",
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8",
        "id": "CVE-2024-45591-f46980f8",
        "signature_version": "v1",
        "digest": {
            "length": 1421.0,
            "function_hash": "288475750190715031284230817422013311144"
        },
        "signature_type": "Function"
    }
]

vanir_signatures_modified

"2026-08-12T15:15:33Z"