CVE-2026-24128

mediumPriorität · verfolgen · 24EPSS 0.006 · 46. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.55% (46th) EPSS

CVSS 6.1 · medium

Is it mine?

21 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-26

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0 contain a reflected Cross-site Scripting (XSS) vulnerability, which allows an attacker to craft a malicious URL and execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. This issue has been patched in versions 17.8.0-rc-1, 17.4.5 and 16.10.12. To workaround, the patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.8–7.3

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7

v3.17.3highAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v4.06.5mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:Hsecondary · ENISA EU

v4.06.5mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.05.8mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-79USCWE-79USCWE-79USCWE-80USCWE-80USCWE-80US

betroffene Produkte (21)

Betroffene Produkte und Versionsbereiche.

Open Source xwiki <16.10.12alle Versionencert_bundDE
Open Source xwiki <17.4.5alle Versionencert_bundDE
Open Source xwiki <17.8.0-rc-1alle Versionencert_bundDE
Open Source xwiki< 16.10.12cert_bundDE
Open Source xwiki< 17.4.5cert_bundDE
Open Source xwiki< 17.8.0-rc-1cert_bundDE
xwiki xwiki-platform17.0.0-rc-1, → 17.4.5enisa_euvdEU
xwiki xwiki-platform17.5.0-rc-1, → 17.8.0-rc-1enisa_euvdEU
xwiki xwiki-platform7.0-milestone-2, → 16.10.12enisa_euvdEU
Сообщество свободного программного обеспечения XWiki Platform17.0.0-rc-1 → 17.4.4fstec_bduRU
Сообщество свободного программного обеспечения XWiki Platform17.5.0-rc-1 → 17.7.0fstec_bduRU
Сообщество свободного программного обеспечения XWiki Platform7.2-milestone-2 → 16.4.7fstec_bduRU
xwiki xwiki= 17.0.0nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki17.0.1 → 17.4.5nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki17.6.0 → 17.8.0nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki= 7.0nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki7.0.1 → 16.10.12nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki-rendering= 17.5.0nvdUScpe:2.3:a:xwiki:xwiki-rendering:*:*:*:*:*:*:*:*
Maven org.xwiki.platform:xwiki-platform-web-templates17.0.0-rc-1 → 17.4.5osvUSpkg:maven/org.xwiki.platform/xwiki-platform-web-templates
Maven org.xwiki.platform:xwiki-platform-web-templates17.5.0-rc-1 → 17.8.0-rc-1osvUSpkg:maven/org.xwiki.platform/xwiki-platform-web-templates

20 von 21 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-0206xwiki: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2026-01-25csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in xwiki ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
GHSA-wvqx-m5px-6cmpXWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages2026-01-23ghsa · osvUS
### Impact A reflected cross site scripting (XSS) vulnerability in XWiki allows an attacker to execute arbitrary actions in XWiki with the rights of the victim if the attacker manages to trick a victim into visiting a crafted URL. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. ### Patches This vulnerability has been patched in XWiki 17.8.0RC1, 17.4.5 and 16.10.12. ### Workarounds The [patch](https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71) can be applied manually, only a single line in `templates/logging_macros.vm` needs to be changed, no restart is required. ### References * https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf * https://jira.xwiki.org/browse/XWIKI-23462 ### Attribution We thank Mike Cole @mikecole-mg for discovering and reporting this vulnerability.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund nvd osv NVD CVE.org MITRE

veröffentlicht 2026-01-24geändert 2026-06-17

Referenzen (20)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan