CVE-2024-46978

mediumPriorität · verfolgen · 26EPSS 0.005 · 44. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.52% (44th) EPSS

CVSS 6.5 · medium

Is it mine?

19 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this. This vulnerability is present in XWiki since 13.2-rc-1. This vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters. Users are advised to upgrade. It's possible to fix manually the vulnerability by editing the document `XWiki.Notifications.Code.NotificationPreferenceService` to apply the changes performed in commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 3.6

v3.16.5mediumAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 2.8 · Auswirkung 3.6

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Nsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-648USCWE-648USCWE-648US

betroffene Produkte (19)

Betroffene Produkte und Versionsbereiche.

Open Source xwiki <14.10.21alle Versionencert_bundDE
Open Source xwiki <15.10.1alle Versionencert_bundDE
Open Source xwiki <15.5.5alle Versionencert_bundDE
Open Source xwiki< 14.10.21cert_bundDE
Open Source xwiki< 15.10.1cert_bundDE
Open Source xwiki< 15.5.5cert_bundDE
xwiki xwiki-platform13.2-rc-1, → 14.10.21enisa_euvdEU
xwiki xwiki-platform15.0.0, → 15.5.5enisa_euvdEU
xwiki xwiki-platform15.6.0, → 15.10.1enisa_euvdEU
Сообщество свободного программного обеспечения XWiki Platform≤ 16.0-rc-1fstec_bduRU
Сообщество свободного программного обеспечения XWiki Platform≤ 15.10.1fstec_bduRU
Сообщество свободного программного обеспечения XWiki Platform≤ 15.5.5fstec_bduRU
Сообщество свободного программного обеспечения XWiki Platform13.2-rc-1 → 14.10.21fstec_bduRU
xwiki xwiki13.2 → 14.10.21nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki15.0 → 15.5.5nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki15.6 → 15.10.1nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Maven org.xwiki.platform:xwiki-platform-notifications-ui13.2-rc-1 → 14.10.21osvUSpkg:maven/org.xwiki.platform/xwiki-platform-notifications-ui
Maven org.xwiki.platform:xwiki-platform-notifications-ui15.0-rc-1 → 15.5.5osvUSpkg:maven/org.xwiki.platform/xwiki-platform-notifications-ui
Maven org.xwiki.platform:xwiki-platform-notifications-ui15.6-rc-1 → 15.10.1osvUSpkg:maven/org.xwiki.platform/xwiki-platform-notifications-ui

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2024-2176xwiki: Mehrere SchwachstellenDeutsch2024-09-18csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um Dateien zu manipulieren oder vertrauliche Informationen offenzulegen.
GHSA-r95w-889q-x2gxorg.xwiki.platform:xwiki-platform-notifications-ui is missing checks for notification filter preferences editions2024-09-18ghsa · osvUS
### Impact It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this. This vulnerability is present in XWiki since 13.2-rc-1. ### Patches The vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters. ### Workarounds It's possible to fix manually the vulnerability by editing the document `XWiki.Notifications.Code.NotificationPreferenceService` to apply the changes performed in this commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4. ### References * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-20337 * Commit: e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org) ### Attribution This vulnerability has been reported on Intigriti by @floerer

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund nvd osv NVD CVE.org MITRE

veröffentlicht 2024-09-18geändert 2026-06-17

Referenzen (10)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan