CVE-2024-43400: xwiki — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2024-43400

CVSS 5.4 · Medium EPSS 0,49%

Kerentanan Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') pada xwiki. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.

Rincian

Terbit di NVD: 19 Agustus 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xwiki	xwiki	Semua versi sebelum 14.10.21
xwiki	xwiki	Versi 15.0 hingga sebelum 15.5.5
xwiki	xwiki	Versi 15.6 hingga sebelum 15.10.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v advisory vendor
https://jira.xwiki.org/browse/XWIKI-21810 issue tracking · advisory vendor
https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.