CVE-2024-43400
XWiki Platform allows XSS through XClass name in string properties
Résumé
XWiki Platform allows XSS through XClass name in string properties
Description d'origine
La description telle que publiée par la source (souvent en anglais).
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web jira.xwiki.org