CVE-2024-21648

Published: Jan 9, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don't have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.

Affected (3)

Products: Xwiki: Xwiki

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Xwiki Xwiki	Before 14.10.17
Xwiki Xwiki	From 15.0 to 15.5.3
Xwiki Xwiki	From 15.6 to 15.8

Related CWEs

Improper Handling of Insufficient Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.

References (6)

https://github.com/xwiki/xwiki-platform/commit/4de72875ca49602796165412741033bfdbf1e680

Source: security-advisories@github.com

Patch

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xh35-w7wg-95v3

Source: security-advisories@github.com

Issue TrackingPatchVendor Advisory

https://jira.xwiki.org/browse/XWIKI-21257

Source: security-advisories@github.com

Issue TrackingVendor Advisory

https://github.com/xwiki/xwiki-platform/commit/4de72875ca49602796165412741033bfdbf1e680

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xh35-w7wg-95v3

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://jira.xwiki.org/browse/XWIKI-21257

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.