CVE-2024-45591

Name: CVE-2024-45591
Creator: NVD / NIST
Published: 2024-09-10T16:15:21.34+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.3/10EPSS 3.42%

Last modified Jun 17, 2026

CVE-2024-45591 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. EPSS estimates a 3.42% chance of exploitation in the next 30 days.

Description

XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Probability

3.42%

87.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Xwiki	Xwiki	>= 1.8, < 15.10.9
Xwiki	Xwiki	>= 16.0.0, < 16.3.0

References

https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0fPatch
https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mmVendor Advisory
https://jira.xwiki.org/browse/XWIKI-22052Exploit, Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Sep 10, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-45591?

How severe is CVE-2024-45591?

CVE-2024-45591 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 3.42% probability of exploitation in the next 30 days.

How do I fix CVE-2024-45591?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-45591?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST