Digest · Wednesday
Security digest: July 31, 2024
2 critical advisories.
All digests · RSS · Markdown
Take stock
- Maven: 2 critical advisories (
org.xwiki.platform:xwiki-platform-search-ui,org.xwiki.platform:xwiki-platform-web-templates). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Maven 2
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet CVE-2024-37901 CVSS 9.4 Critical
org.xwiki.platform:xwiki-platform-search-ui>= 9.2-rc-1, < 14.10.21 → fixed in 14.10.21;org.xwiki.platform:xwiki-platform-search-ui>= 15.0-rc-1, < 15.5.5 → fixed in 15.5.5;org.xwiki.platform:xwiki-platform-search-ui>= 15.6-rc-1, < 15.10.2 → fixed in 15.10.2 - XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution CVE-2024-41947 CVSS 9.4 Critical
org.xwiki.platform:xwiki-platform-web-templates>= 11.8-rc-1, < 15.10.8 → fixed in 15.10.8;org.xwiki.platform:xwiki-platform-web-templates>= 16.0.0-rc-1, < 16.3.0-rc-1 → fixed in 16.3.0-rc-1