{"id":"CVE-2024-43400","aliases":["EUVD-2024-2676","GHSA-wcg9-pgqv-xm5v"],"status":"published","title":"XWiki Platform allows XSS through XClass name in string properties","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00488,"percentile":0.42512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79","CWE-96"],"published":"2024-08-19T16:24:40Z","modified":"2026-10-28T10:42:05Z","exploits":[{"source":"pocgithub","id":"rain321654/CVE-2024-43400","title":"rain321654/CVE-2024-43400","date":"2025-12-16","url":"https://github.com/rain321654/CVE-2024-43400"},{"source":"pocgithub","id":"rain321654/yasa-cve-2024-43400-main1","title":"rain321654/yasa-cve-2024-43400-main1","date":"2025-12-15","url":"https://github.com/rain321654/yasa-cve-2024-43400-main1"}],"fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","fixed_in":["14.10.21","15.5.5","15.10.6","16.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.2"},{"fixed":"14.10.21"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0-rc-1"},{"fixed":"15.5.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.6-rc-1"},{"fixed":"15.10.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-rc-1"},{"last_affected":"16.0.0-rc-1"},{"fixed":"16.0.0"}]}],"versions":["16.0.0-rc-1"]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.2"},{"fixed":"14.10.21"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0-rc-1"},{"fixed":"15.5.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.6-rc-1"},{"fixed":"15.10.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-rc-1"},{"fixed":"16.0.0"}]}],"versions":["16.0.0-rc-1"]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21810","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43400","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wcg9-pgqv-xm5v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43400.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-43400","title":"XWiki Platform allows XSS through XClass name in string properties","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.","status":"published","published":"2024-08-19T16:24:40.9Z","modified":"2024-08-22T14:00:37.297Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-96"],"updated_at":"2026-11-02T14:33:58.839967Z"}],"euvd":[{"id":"EUVD-2024-2676","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.","status":"published","published":"2024-08-19T16:24:40Z","modified":"2024-08-22T14:00:37Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:13.216602Z"}],"ghsa":[{"id":"GHSA-wcg9-pgqv-xm5v","title":"XWiki Platform allows XSS through XClass name in string properties","description":"### Impact\nIs it possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript.\nThis requires social engineer to trick a user to follow the URL.\n\n#### Reproduction steps\n\n1. As a user without script or programming right, create a (non-terminal) document named `\" + alert(1) + \"` (the quotes need to be part of the name).\n1. Edit the class.\n1. Add a string property named `\"test\"`.\n1. Edit using the object editor and add an object of the created class\n1. Get an admin to open `\u003cxwiki-server\u003e/xwiki/bin/view/%22%20%2B%20alert(1)%20%2B%20%22/?viewer=display\u0026type=object\u0026property=%22%20%2B%20alert(1)%20%2B%20%22.WebHome.test\u0026mode=edit` where `\u003cxwiki-server\u003e` is the URL of your XWiki installation.\n\n### Patches\nThis has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.\n\n### Workarounds\n\nWe're not aware of any workaround except upgrading.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-21810\n- https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c\n","status":"published","published":"2024-08-19T21:49:07Z","modified":"2024-08-20T18:44:54Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-79","CWE-96"],"updated_at":"2026-11-02T14:37:59.336921Z"}],"nvd":[{"id":"CVE-2024-43400","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.","status":"published","published":"2024-08-19T17:15:09.097Z","modified":"2026-06-17T07:50:58.447Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-96","CWE-79"],"updated_at":"2026-11-02T14:10:19.870727Z"}],"osv":[{"id":"CVE-2024-43400","title":"XWiki Platform allows XSS through XClass name in string properties","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.","status":"published","published":"2024-08-19T16:24:40.9Z","modified":"2026-10-28T10:42:05.984238364Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-96"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"GHSA-wcg9-pgqv-xm5v","title":"XWiki Platform allows XSS through XClass name in string properties","description":"### Impact\nIs it possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript.\nThis requires social engineer to trick a user to follow the URL.\n\n#### Reproduction steps\n\n1. As a user without script or programming right, create a (non-terminal) document named `\" + alert(1) + \"` (the quotes need to be part of the name).\n1. Edit the class.\n1. Add a string property named `\"test\"`.\n1. Edit using the object editor and add an object of the created class\n1. Get an admin to open `\u003cxwiki-server\u003e/xwiki/bin/view/%22%20%2B%20alert(1)%20%2B%20%22/?viewer=display\u0026type=object\u0026property=%22%20%2B%20alert(1)%20%2B%20%22.WebHome.test\u0026mode=edit` where `\u003cxwiki-server\u003e` is the URL of your XWiki installation.\n\n### Patches\nThis has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.\n\n### Workarounds\n\nWe're not aware of any workaround except upgrading.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-21810\n- https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c\n","status":"published","published":"2024-08-19T21:49:07Z","modified":"2024-08-19T22:12:04.122478Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-79","CWE-96"],"updated_at":"2026-11-02T15:46:58.401149Z"}]}}