CVE-2024-37898

4.3 · MEDIUM

Published Jul 31, 2024 xwiki CWE-862 EPSS 0.40% (33th pctl) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Overview

CVE-2024-37898 is a medium-severity vulnerability affecting xwiki xwiki. It was published on July 31, 2024 and has a CVSS 3.1 base score of 4.3 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 4.3, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in XWiki, that user can delete the page and replace it by a page with new content without having delete right. The previous version of the page is moved into the recycle bin and can be restored from there by an admin. As the user is recorded as deleter, the user would in theory also be able to view the deleted content, but this is not directly possible as rights of the previous version are transferred to the new page and thus the user still doesn't have view right on the page. It therefore doesn't seem to be possible to exploit this to gain any rights. This has been patched in XWiki 14.10.21, 15.5.5 and 15.10.6 by cancelling save operations by users when a new document shall be saved despite the document's existing already.

Remediation

Check the references section for vendor advisories and patches from xwiki. Update xwiki to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
xwiki	xwiki	>= 13.10.4, < 14.0	Affected

References

GitHub github.com/xwiki/xwiki-platform/commit/0bc27d6ec63c8a505ff950e2d1792cb4f773c22e GitHub github.com/xwiki/xwiki-platform/commit/56f5d8aab7371d5ba891168f73890806551322c5 GitHub github.com/xwiki/xwiki-platform/commit/c5efc1e519e710afdf3c5f40c0fcc300ad77149f GitHub github.com/xwiki/xwiki-platform/commit/e4968fe268e5644ffd9bfa4ef6257d2796446009 GitHub github.com/xwiki/xwiki-platform/security/advisories/GHSA-33gp-gmg3-hfpq Ref jira.xwiki.org/browse/XWIKI-21553

Frequently Asked Questions

What is CVE-2024-37898?

CVE-2024-37898 is a medium-severity vulnerability affecting xwiki xwiki. It was published on July 31, 2024 and has a CVSS 3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2024-37898?

This vulnerability has a CVSS 3.1 base score of 4.3, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-37898?

How can CyberStrike help with CVE-2024-37898?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-37898 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719