Executive brief
In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
Affected products
- Maven org.xwiki.platform:xwiki-platform-web-templates
Junglewise Threat Intelligence
CVE-2024-43401: In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
CVE-2024-43401 · Severity: low · CVSS 3.1 · Published 2024-08-19
Technologies: org.xwiki.platform:xwiki-platform-web-templates (Maven). Vendors: Maven.
Related threats
- XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer
- xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
- XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor