CVE-2024-21648: XWiki has no right protection on rollback action
Impact
The rollback action is missing a right protection: it means that a user can rollback to a previous version of the page to gain rights they don't have anymore. This vulnerability impacts all version of XWiki since rollback action is available.
Patches
The problem has been patched in XWiki 14.10.16, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.
Workarounds
There's no workaround for this vulnerability, except paying attention to delete old versions of documents that could allow users to gain more rights.
References
JIRA ticket: https://jira.xwiki.org/browse/XWIKI-21257 Commit: 4de72875ca49602796165412741033bfdbf1e680
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don't have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platformto a version that resolves this vulnerability.Fixed in 15.8-rc-1 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platformto a version that resolves this vulnerability.Fixed in 15.5.3 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-oldcoreto a version that resolves this vulnerability.Fixed in 14.10.17 - Upgrade
Upgrade
XWikito a version that resolves this vulnerability.Fixed in 14.10.16 - Upgrade
Upgrade
XWikito a version that resolves this vulnerability.Fixed in 15.5.3 - Upgrade
Upgrade
XWikito a version that resolves this vulnerability.Fixed in 15.8-rc-1 - Compensating control
Ensure old page versions that could allow users to gain more rights are deleted, since there is no workaround and the vulnerability can affect users via rollback to previous versions.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21648?
CVE-2024-21648 is considered a high severity vulnerability due to its potential for unauthorized access through the rollback action.
How do I fix CVE-2024-21648?
To fix CVE-2024-21648, upgrade to XWiki version 15.8-rc-1, 15.5.3, or 14.10.17.
Which versions of XWiki are affected by CVE-2024-21648?
All versions of XWiki are affected by CVE-2024-21648 since the rollback functionality is available across them.
What impact does CVE-2024-21648 have on users?
CVE-2024-21648 allows users to gain access to rights they no longer have by rolling back to previous versions of pages.
Is there a workaround for CVE-2024-21648?
There is no official workaround for CVE-2024-21648; upgrading to the fixed versions is the recommended action.