CVE-2024-41947
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- EPSS probability
- 1.67%
- CWE
- CWE-80
- Published
- 2024-07-31
- Last modified
- 2026-03-13
Affected products
- xwiki xwiki-platform
- xwiki xwiki-platform
Weakness type
Related vulnerabilities
- CVE-2026-52774 — Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki
- CVE-2026-52773 — Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki
- CVE-2026-32773 — Apache Spark: XSS Vulnerability in Spark Web 3.5.4
- CVE-2026-82838 — Default webserver configuration with incorrect CSP
- CVE-2026-55696 — PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
- CVE-2026-5218 — HTML Injection in Softtr's E-Commerce Pack
- CVE-2026-5389 — justhtml before 1.13.0 XSS via code fence breakout
- CVE-2026-35163 — OctoPrint: XSS in Suppressed Command Notifications