HTTP: XWiki.org XWiki Upload Reflected Cross-Site Scripting

This signature detects attempts to exploit a known cross-site scripting vulnerability against XWiki.org XWiki Upload. It is due to insufficient validation of user-supplied input. Attackers can steal cookie-based authentication credentials and launch other attacks.

Extended Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the victim into uploading a file with a malicious name. The malicious code is solely executed during the upload and affects only the user uploading the attachment. While this allows performing actions in the name of that user, it seems unlikely that a user wouldn't notice the malicious filename while uploading the attachment. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.

Affected Products

Xwiki xwiki

References

CVE: CVE-2024-37900

URL: https://github.com/advisories/GHSA-wf3x-jccf-5g5g

Short Name

HTTP:XSS:XWIKI-UPLD-REFLECTED

Severity

Major

Recommended

False

Recommended Action

None

HTTP: XWiki.org XWiki Upload Reflected Cross-Site Scripting

Extended Description

Affected Products

References

Found a potential security threat?