{"id":"CVE-2024-41947","summary":"XWiki Platform XSS through conflict resolution","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.","aliases":["GHSA-692v-783f-mg8x"],"modified":"2026-08-12T14:52:12.593027Z","published":"2024-07-31T15:24:20.271Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-80"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41947.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-21626"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41947.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-692v-783f-mg8x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41947"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"4f2045d9c2db9a7cb240aa995071d416fce345b5"},{"fixed":"63e05b1723e99d6914e6be23572cbb16affa6fd1"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"ed06afe4614a2782ddac6e42ed21f180056a206e"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"11.8"},{"fixed":"15.10.8"},{"introduced":"16.0"},{"fixed":"16.3.0"}]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"42b694196dbe432980fd5c77f725a6533efbbb97"},{"fixed":"4524f78640db8d9d09d8706682663a7bed574741"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"50fb1f191827504c6173697d6c39aa093301a851"},{"fixed":"821d43ec45e67d45a6735a0717b9b77fffc1cd9f"},{"fixed":"e00e159d3737397eebd1f6ff925c1f5cb7cdec34"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"11.8"},{"fixed":"15.10.8"},{"introduced":"16.0"},{"fixed":"16.3.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"vanir_signatures_modified":"2026-08-12T14:52:12Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34","target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java"},"deprecated":false,"digest":{"line_hashes":["21155742351908933010213828537043375122","273166470439608780614388405906396775011","257802522662050657643952040823402044512","229476200234515363868841825713592731625","248459148515579882089514317394450952605","225805416268014336793980877945859740920","3069364051456673488025796464750280495","193224163244773286660232109753531851063","288403268691264797168806873703562657529","153420000428550045532760707455047246693","227030252882608813056940215681387162889","136434656779224626169361800611357890889","158834344623340583666815344593027121470","193224163244773286660232109753531851063","1332571388758168851027022748764812579","44905972275475979883088220851302570980","78840683487569123086098334486816543326","231642458328221174279473971436277455798","171319635799392374080661634281621187601","37375601237918814507296090296663130447"],"threshold":0.9},"id":"CVE-2024-41947-2dd52f24"},{"id":"CVE-2024-41947-4613ad70","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f","target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java"},"deprecated":false,"digest":{"line_hashes":["21155742351908933010213828537043375122","273166470439608780614388405906396775011","257802522662050657643952040823402044512","229476200234515363868841825713592731625","248459148515579882089514317394450952605","225805416268014336793980877945859740920","3069364051456673488025796464750280495","193224163244773286660232109753531851063","288403268691264797168806873703562657529","153420000428550045532760707455047246693","227030252882608813056940215681387162889","136434656779224626169361800611357890889","158834344623340583666815344593027121470","193224163244773286660232109753531851063","1332571388758168851027022748764812579","44905972275475979883088220851302570980","78840683487569123086098334486816543326","231642458328221174279473971436277455798","171319635799392374080661634281621187601","37375601237918814507296090296663130447"],"threshold":0.9}},{"id":"CVE-2024-41947-ceeb177d","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/821d43ec45e67d45a6735a0717b9b77fffc1cd9f","target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java","function":"editWithConflict"},"deprecated":false,"digest":{"function_hash":"193954538563252037518932632250007806634","length":10868}},{"deprecated":false,"digest":{"function_hash":"193954538563252037518932632250007806634","length":10868},"id":"CVE-2024-41947-f82bc77e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e00e159d3737397eebd1f6ff925c1f5cb7cdec34","target":{"function":"editWithConflict","file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41947.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}