CVE-2024-21648

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don't have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.

• CWE-274

• https://github.com/xwiki/xwiki-platform/commit/4de72875ca49602796165412741033bfdbf1e680Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xh35-w7wg-95v3Issue Tracking, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21257Issue Tracking, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/4de72875ca49602796165412741033bfdbf1e680Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xh35-w7wg-95v3Issue Tracking, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21257Issue Tracking, Vendor Advisory

Published

Jan 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21642D-Tale is a visualizer for Pandas data structures. Users hos…7.5
• CVE-2024-21643IdentityModel Extensions for .NET provide assemblies for web…8.8
• CVE-2024-21644pyLoad is the free and open-source Download Manager written …7.5
• CVE-2024-21645pyLoad is the free and open-source Download Manager written …5.3
• CVE-2024-21646Azure uAMQP is a general purpose C library for AMQP 1.0. The…9.8
• CVE-2024-21647Puma is a web server for Ruby/Rack applications built for pa…7.5
• CVE-2024-21649The vantage6 technology enables to manage and deploy privacy…8.8
• CVE-2024-2165The SEOPress – On-site SEO plugin for WordPress is vulnerabl…5.4
• CVE-2024-21650XWiki Platform is a generic wiki platform offering runtime s…9.8
• CVE-2024-21651XWiki Platform is a generic wiki platform offering runtime s…6.5
• CVE-2024-21652Argo CD is a declarative, GitOps continuous delivery tool fo…9.8
• CVE-2024-21653The vantage6 technology enables to manage and deploy privacy…9.8