{"id":"CVE-2024-43400","summary":"XWiki Platform allows XSS through XClass name in string properties","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.","aliases":["GHSA-wcg9-pgqv-xm5v"],"modified":"2026-08-12T15:15:28.981386Z","published":"2024-08-19T16:24:40.900Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-96"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43400.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-21810"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43400.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43400"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"c6cc6af0637c7e8f8be850fe4af66576934f8a53"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"5583e277218ab5de9930d969082a19ed0db4e472"},{"introduced":"1e0e26611ad39442be884e876d902441a51fd34a"},{"fixed":"5408ff53a61f0775cc5314a7ccde04c61c84caba"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"14.10.21"},{"introduced":"15.0"},{"fixed":"15.5.5"},{"introduced":"15.6"},{"fixed":"15.10.6"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"fixed":"1bcc6e962dc5701ae6f9745a209a5c0c97461128"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"447f13c6b159cf0671b65c6be8f790cf046d7ada"},{"introduced":"cb249a1a7570161ad6672449fbe89485fb489e95"},{"fixed":"150468c1e2cd64a2ad85b5053e9487943d3b9b1f"},{"fixed":"27eca8423fc1ad177518077a733076821268509c"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"14.10.21"},{"introduced":"15.0"},{"fixed":"15.5.5"},{"introduced":"15.6"},{"fixed":"15.10.6"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["= 16.0.0-rc-1","xwiki-commons-15.10.5","xwiki-commons-15.10.4","xwiki-commons-15.10.3","xwiki-commons-15.10.2","xwiki-commons-15.10.1","xwiki-commons-14.10.20","xwiki-commons-15.5.4","xwiki-commons-15.10","xwiki-commons-15.10-rc-1","xwiki-commons-14.10.19","xwiki-commons-14.10.18","xwiki-commons-15.5.3","xwiki-commons-14.10.17","xwiki-commons-14.10.16","xwiki-commons-15.5.2","xwiki-commons-14.10.15","xwiki-commons-15.5.1","xwiki-commons-14.10.14","xwiki-commons-15.5","xwiki-commons-14.10.13","xwiki-commons-15.5-rc-1","xwiki-commons-14.10.12","xwiki-commons-14.10.11","xwiki-commons-14.10.10","xwiki-commons-14.10.9","xwiki-commons-14.10.8","xwiki-commons-14.10.7","xwiki-commons-14.10.6","xwiki-commons-14.10.5","xwiki-commons-14.10.4","xwiki-commons-14.10.3","xwiki-commons-14.10.2","xwiki-commons-14.10.1","xwiki-commons-14.10","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-16.0.0-rc-1","xwiki-platform-15.10.5","xwiki-platform-15.10.4","xwiki-platform-15.10.3","xwiki-platform-15.10.2","xwiki-platform-15.10.1","xwiki-platform-14.10.20","xwiki-platform-15.5.4","xwiki-platform-15.10","xwiki-platform-15.10-rc-1","xwiki-platform-14.10.19","xwiki-platform-14.10.18","xwiki-platform-15.5.3","xwiki-platform-14.10.17","xwiki-platform-14.10.16","xwiki-platform-15.5.2","xwiki-platform-14.10.15","xwiki-platform-15.5.1","xwiki-platform-14.10.14","xwiki-platform-15.5","xwiki-platform-14.10.13","xwiki-platform-15.5-rc-1","xwiki-platform-14.10.12","xwiki-platform-14.10.11","xwiki-platform-14.10.10","xwiki-platform-14.10.9","xwiki-platform-14.10.8","xwiki-platform-14.10.7","xwiki-platform-14.10.6","xwiki-platform-14.10.5","xwiki-platform-14.10.4","xwiki-platform-14.10.3","xwiki-platform-14.10.2","xwiki-platform-14.10.1","xwiki-platform-14.10","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43400.json","vanir_signatures_modified":"2026-08-12T15:15:28Z","vanir_signatures":[{"source":"https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/StringClass.java","function":"displayEdit"},"deprecated":false,"digest":{"function_hash":"44523286232865003206711423276447308424","length":1025},"id":"CVE-2024-43400-182fe193","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/StringClass.java"},"deprecated":false,"digest":{"line_hashes":["250210350337016613504990194401767809759","81022745027328020218541956541465076802","277089455802837876329505474539812530932","10264008199618261152120864714454322495","61967600956818476115245001605408020683","267687967142196119638719841529487517654","277029516981029085169378470242183948259","198563120212623393066283799738553444453","266398178995904076115118901183689764261","74131165651961702893974221466117410856","313231401384505902355826901341045556802","144432212504479539061822411285177808403","206990992398046408215187810023128335613","295168326687055720225027019764988946804","244271650478131134196491293915036271765","171065788028851623193261153173967940545","269398836738864210637576866897273889470","330370400924928762398931438321845592889","171991923339964778510958774603960784883","144221576750534414025020802918583167612","80702234498086116032930967971682940522","98499692487043279032664618583717725289","190281242013073237458062658982212828503","318781784628591304205867891807767175809","227902810019147919906990025031340049399","123914879281998092751594126993658475242","18339931596985506680971340450446273579","81497573777431790572629694085290725523"],"threshold":0.9},"id":"CVE-2024-43400-6b1458e5","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}