{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-46978", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-09-16T16:10:09.017Z", "datePublished": "2024-09-18T17:25:15.821Z", "dateUpdated": "2024-09-20T13:34:31.694Z"}, "containers": {"cna": {"title": "Missing checks for notification filter preferences editions in XWiki Platform", "problemTypes": [{"descriptions": [{"cweId": "CWE-648", "lang": "en", "description": "CWE-648: Incorrect Use of Privileged APIs", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx"}, {"name": "https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4", "tags": ["x_refsource_MISC"], "url": "https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4"}, {"name": "https://jira.xwiki.org/browse/XWIKI-20337", "tags": ["x_refsource_MISC"], "url": "https://jira.xwiki.org/browse/XWIKI-20337"}], "affected": [{"vendor": "xwiki", "product": "xwiki-platform", "versions": [{"version": ">= 13.2-rc-1, < 14.10.21", "status": "affected"}, {"version": ">= 15.0.0, < 15.5.5", "status": "affected"}, {"version": ">= 15.6.0, < 15.10.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-18T17:25:15.821Z"}, "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this. This vulnerability is present in XWiki since 13.2-rc-1. This vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters. Users are advised to upgrade. It's possible to fix manually the vulnerability by editing the document `XWiki.Notifications.Code.NotificationPreferenceService` to apply the changes performed in commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4."}], "source": {"advisory": "GHSA-r95w-889q-x2gx", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "xwiki", "product": "xwiki-platform", "cpes": ["cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "13.2-rc-1", "status": "affected", "lessThanOrEqual": "14.10.21", "versionType": "custom"}, {"version": "15.0.0", "status": "affected", "lessThanOrEqual": "15.5.5", "versionType": "custom"}, {"version": "15.10.1", "status": "affected", "lessThanOrEqual": "15.6.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-20T13:34:23.555950Z", "id": "CVE-2024-46978", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-20T13:34:31.694Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-46978", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-20T13:34:23.555950Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*"], "vendor": "xwiki", "product": "xwiki-platform", "versions": [{"status": "affected", "version": "13.2-rc-1", "versionType": "custom", "lessThanOrEqual": "14.10.21"}, {"status": "affected", "version": "15.0.0", "versionType": "custom", "lessThanOrEqual": "15.5.5"}, {"status": "affected", "version": "15.10.1", "versionType": "custom", "lessThanOrEqual": "15.6.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-18T18:47:27.751Z"}}], "cna": {"title": "Missing checks for notification filter preferences editions in XWiki Platform", "source": {"advisory": "GHSA-r95w-889q-x2gx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "xwiki", "product": "xwiki-platform", "versions": [{"status": "affected", "version": ">= 13.2-rc-1, < 14.10.21"}, {"status": "affected", "version": ">= 15.0.0, < 15.5.5"}, {"status": "affected", "version": ">= 15.6.0, < 15.10.1"}]}], "references": [{"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx", "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4", "name": "https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.xwiki.org/browse/XWIKI-20337", "name": "https://jira.xwiki.org/browse/XWIKI-20337", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this. This vulnerability is present in XWiki since 13.2-rc-1. This vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters. Users are advised to upgrade. It's possible to fix manually the vulnerability by editing the document `XWiki.Notifications.Code.NotificationPreferenceService` to apply the changes performed in commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-648", "description": "CWE-648: Incorrect Use of Privileged APIs"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-18T17:25:15.821Z"}}}, "cveMetadata": {"cveId": "CVE-2024-46978", "state": "PUBLISHED", "dateUpdated": "2024-09-20T13:34:31.694Z", "dateReserved": "2024-09-16T16:10:09.017Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-09-18T17:25:15.821Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this. This vulnerability is present in XWiki since 13.2-rc-1. This vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters. Users are advised to upgrade. It's possible to fix manually the vulnerability by editing the document `XWiki.Notifications.Code.NotificationPreferenceService` to apply the changes performed in commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4."}, {"lang": "es", "value": "XWiki Platform es una plataforma wiki gen\u00e9rica que ofrece servicios de ejecuci\u00f3n para aplicaciones creadas sobre ella. Es posible que cualquier usuario que conozca el ID de una preferencia de filtro de notificaciones de otro usuario la habilite, deshabilite o incluso elimine. El impacto es que el usuario objetivo puede comenzar a perder notificaciones en algunas p\u00e1ginas debido a esto. Esta vulnerabilidad est\u00e1 presente en XWiki desde 13.2-rc-1. Esta vulnerabilidad ha sido parcheada en XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. El parche consiste en verificar correctamente los derechos del usuario antes de realizar cualquier acci\u00f3n en los filtros. Se recomienda a los usuarios que actualicen. Es posible corregir manualmente la vulnerabilidad editando el documento `XWiki.Notifications.Code.NotificationPreferenceService` para aplicar los cambios realizados en el commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4."}], "id": "CVE-2024-46978", "lastModified": "2024-09-20T12:30:17.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-09-18T18:15:06.800", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4"}, {"source": "security-advisories@github.com", "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx"}, {"source": "security-advisories@github.com", "url": "https://jira.xwiki.org/browse/XWIKI-20337"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-648"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}