{"id":"CVE-2024-45591","summary":"XWiki Platform document history including authors of any page exposed to unauthorized actors","details":"XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.","aliases":["GHSA-pvmm-55r5-g3mm"],"modified":"2026-08-12T15:15:33.683534Z","published":"2024-09-10T15:56:53.484Z","database_specific":{"cwe_ids":["CWE-359","CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45591.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22052"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45591.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45591"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"10aac24eea2647c0e044176c369755baf8c5a5f1"},{"fixed":"3f100aee4c197e68d2986717a878d0bbd4fb0c22"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"ed06afe4614a2782ddac6e42ed21f180056a206e"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8"},{"fixed":"15.10.9"},{"introduced":"16.0.0"},{"fixed":"16.3.0"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"943ce46958cb17adcf82e8fa381fb36616646f0b"},{"fixed":"1c4b9ba5f04cd8d636a6718465a0b8e251f51420"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"50fb1f191827504c6173697d6c39aa093301a851"},{"fixed":"26482ee5d29fc21f31134d1ee13db48716e89e0f"},{"fixed":"9cbca9808300797c67779bb9a665d85cf9e3d4b8"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8"},{"fixed":"15.10.9"},{"introduced":"16.0.0"},{"fixed":"16.3.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45591.json","vanir_signatures_modified":"2026-08-12T15:15:33Z","vanir_signatures":[{"target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java","function":"getPageTranslationHistory"},"deprecated":false,"digest":{"function_hash":"288475750190715031284230817422013311144","length":1421},"id":"CVE-2024-45591-0e7ad348","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java","function":"getPageHistory"},"deprecated":false,"digest":{"function_hash":"308361931181380220859253464077646852597","length":1391},"id":"CVE-2024-45591-770dc1ad"},{"id":"CVE-2024-45591-89aa7506","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java","function":"getPageHistory"},"deprecated":false,"digest":{"function_hash":"308361931181380220859253464077646852597","length":1391}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java"},"deprecated":false,"digest":{"line_hashes":["3040236606649621333377421367846740581","124761170461509244545270863193178880832","168078324775925323646511532571686813552","177779699407833604672352283748281317230","108911551660315955580511635272232778424","292073498605713314552312496184590363330","22772543593571939177495608406649351170","268046476405665234545111053989912068098","285602288944094074055009975546446072534","147170873860239309388372509952432288515","13275910919432188171641581003966317601","156503891472406369870966731551636736622","201624936566598416179643849206898656511","36507558003979839350355750298506800583","126494544728243324795114897360729489429","106182330578261922465410442201295882259","328619401425764327412398246037401280928","189770970410034781833166921717845264808"],"threshold":0.9},"id":"CVE-2024-45591-ab3aa6cd"},{"id":"CVE-2024-45591-ab76d70e","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["3040236606649621333377421367846740581","124761170461509244545270863193178880832","168078324775925323646511532571686813552","177779699407833604672352283748281317230","108911551660315955580511635272232778424","165204978348614368254239538202378841577","214592701342727098019962265405349190137","29932313973199257229427411065157382442","32611891693385186983493132068205749356","30218208481750828242496099718341114654","162803263138568120545131874020830083568","171821600779831736144197423289092474836","148840285311347729292565946799325704984","25381539997341389054568704540019226704","196949271056384777673118191462390786624","189300672521638578620700962368824447204","328619401425764327412398246037401280928","189770970410034781833166921717845264808"]}},{"deprecated":false,"digest":{"line_hashes":["3040236606649621333377421367846740581","124761170461509244545270863193178880832","168078324775925323646511532571686813552","177779699407833604672352283748281317230","108911551660315955580511635272232778424","165204978348614368254239538202378841577","214592701342727098019962265405349190137","29932313973199257229427411065157382442","32611891693385186983493132068205749356","30218208481750828242496099718341114654","162803263138568120545131874020830083568","171821600779831736144197423289092474836","148840285311347729292565946799325704984","25381539997341389054568704540019226704","196949271056384777673118191462390786624","189300672521638578620700962368824447204","328619401425764327412398246037401280928","189770970410034781833166921717845264808"],"threshold":0.9},"id":"CVE-2024-45591-bd618136","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java"}},{"digest":{"threshold":0.9,"line_hashes":["3040236606649621333377421367846740581","124761170461509244545270863193178880832","168078324775925323646511532571686813552","177779699407833604672352283748281317230","108911551660315955580511635272232778424","292073498605713314552312496184590363330","22772543593571939177495608406649351170","268046476405665234545111053989912068098","285602288944094074055009975546446072534","147170873860239309388372509952432288515","13275910919432188171641581003966317601","156503891472406369870966731551636736622","201624936566598416179643849206898656511","36507558003979839350355750298506800583","126494544728243324795114897360729489429","106182330578261922465410442201295882259","328619401425764327412398246037401280928","189770970410034781833166921717845264808"]},"id":"CVE-2024-45591-c007aea0","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java","function":"getPageTranslationHistory"},"deprecated":false,"digest":{"function_hash":"288475750190715031284230817422013311144","length":1421},"id":"CVE-2024-45591-f46980f8","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}