{"id":"CVE-2024-43401","aliases":["EUVD-2024-2572","GHSA-f963-4cq8-2gw7"],"status":"published","title":"In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00677,"percentile":0.52622,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-862"],"published":"2024-08-19T16:24:29Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web-templates","fixed_in":["15.10-rc-1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.10-rc-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.10-rc-1"}]}]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20331","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21311","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21481","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21482","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21483","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21484","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21485","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21486","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21487","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21488","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21489","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-21490","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43401","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f963-4cq8-2gw7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43401.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-43401","title":"In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.","status":"published","published":"2024-08-19T16:24:29.698Z","modified":"2024-08-21T14:23:29.403Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:33:58.357949Z"}],"euvd":[{"id":"EUVD-2024-2572","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.","status":"published","published":"2024-08-19T16:24:29Z","modified":"2024-08-21T14:23:29Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:14.188111Z"}],"ghsa":[{"id":"GHSA-f963-4cq8-2gw7","title":"In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them","description":"### Impact\n\nA user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor.\nThe user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content.\nThe payload is executed at edit time.\n\n### Patches\n\nThis vulnerability has been patched in XWiki 15.10RC1.\n\n### Workarounds\n\nNo workaround. It is advised to upgrade to XWiki 15.10+.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-20331\n* https://jira.xwiki.org/browse/XWIKI-21311\n* https://jira.xwiki.org/browse/XWIKI-21481\n* https://jira.xwiki.org/browse/XWIKI-21482\n* https://jira.xwiki.org/browse/XWIKI-21483\n* https://jira.xwiki.org/browse/XWIKI-21484\n* https://jira.xwiki.org/browse/XWIKI-21485\n* https://jira.xwiki.org/browse/XWIKI-21486\n* https://jira.xwiki.org/browse/XWIKI-21487\n* https://jira.xwiki.org/browse/XWIKI-21488\n* https://jira.xwiki.org/browse/XWIKI-21489\n* https://jira.xwiki.org/browse/XWIKI-21490\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThis vulnerability has been reported on Intigriti by @floerer","status":"published","published":"2024-08-19T21:49:15Z","modified":"2024-08-20T18:44:58Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269","CWE-862"],"updated_at":"2026-11-02T14:37:59.336921Z"}],"nvd":[{"id":"CVE-2024-43401","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.","status":"published","published":"2024-08-19T17:15:09.317Z","modified":"2026-06-17T07:50:58.557Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-269","CWE-862"],"updated_at":"2026-11-02T14:10:19.870727Z"}],"osv":[{"id":"CVE-2024-43401","title":"In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.","status":"published","published":"2024-08-19T16:24:29.698Z","modified":"2026-10-28T02:30:27.870199419Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"GHSA-f963-4cq8-2gw7","title":"In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them","description":"### Impact\n\nA user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor.\nThe user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content.\nThe payload is executed at edit time.\n\n### Patches\n\nThis vulnerability has been patched in XWiki 15.10RC1.\n\n### Workarounds\n\nNo workaround. It is advised to upgrade to XWiki 15.10+.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-20331\n* https://jira.xwiki.org/browse/XWIKI-21311\n* https://jira.xwiki.org/browse/XWIKI-21481\n* https://jira.xwiki.org/browse/XWIKI-21482\n* https://jira.xwiki.org/browse/XWIKI-21483\n* https://jira.xwiki.org/browse/XWIKI-21484\n* https://jira.xwiki.org/browse/XWIKI-21485\n* https://jira.xwiki.org/browse/XWIKI-21486\n* https://jira.xwiki.org/browse/XWIKI-21487\n* https://jira.xwiki.org/browse/XWIKI-21488\n* https://jira.xwiki.org/browse/XWIKI-21489\n* https://jira.xwiki.org/browse/XWIKI-21490\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThis vulnerability has been reported on Intigriti by @floerer","status":"published","published":"2024-08-19T21:49:15Z","modified":"2024-08-19T22:12:04.199287Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-269","CWE-862"],"updated_at":"2026-11-02T15:46:46.006631Z"}]}}