CVE-2024-21651

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub_MCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
VendorProductVersion
xwikixwiki
14.10 ≤
𝑥
< 14.10.18
xwikixwiki
15.5 ≤
𝑥
< 15.5.3
xwikixwiki
15.6 ≤
𝑥
< 15.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8959-rfxh-r4j4
https://jira.xwiki.org/browse/XCOMMONS-2796
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8959-rfxh-r4j4
https://jira.xwiki.org/browse/XCOMMONS-2796