---
title: "CVE-2024-43400: XWiki Platform allows XSS through XClass name in string properties"
url: https://erroneo.us/security/cve/CVE-2024-43400/
description: "CVE-2024-43400 (org.xwiki.platform:xwiki-platform-oldcore (Maven)): XWiki Platform is a generic wiki platform offering runtime services for applications…"
type: vulnerability-record
section: "Security Digest"
date_published: 2024-08-19
date_modified: 2024-08-22
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2024-43400"
kev: false
cvss: 9.4
epss: 0.00488
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2024-43400: XWiki Platform allows XSS through XClass name in string properties

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.5% , percentile 41: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 41% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes org.xwiki.platform:xwiki-platform-oldcore (Maven) >= 1.1.2, < 14.10.21, fixed in 14.10.21 ; org.xwiki.platform:xwiki-platform-oldcore (Maven) >= 15.0-rc-1, < 15.5.5, fixed in 15.5.5 ; org.xwiki.platform:xwiki-platform-oldcore (Maven) >= 15.6-rc-1, < 15.10.6, fixed in 15.10.6 ; org.xwiki.platform:xwiki-platform-oldcore (Maven) = 16.0.0-rc-1, fixed in 16.0.0 . Check your lockfile, including transitive dependencies.

## What it is

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.

## Affected packages

- Maven `org.xwiki.platform:xwiki-platform-oldcore` >= 1.1.2, < 14.10.21 → fixed: 14.10.21
- Maven `org.xwiki.platform:xwiki-platform-oldcore` >= 15.0-rc-1, < 15.5.5 → fixed: 15.5.5
- Maven `org.xwiki.platform:xwiki-platform-oldcore` >= 15.6-rc-1, < 15.10.6 → fixed: 15.10.6
- Maven `org.xwiki.platform:xwiki-platform-oldcore` = 16.0.0-rc-1 → fixed: 16.0.0

## Affected products (CVE record)

- xwiki xwiki-platform: >= 15.6-rc-1, < 15.10.2, >= 15.0-rc-1, < 15.5.5, < 14.10.21, = 16.0.0-rc-1

## Severity

- GitHub_M CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H`
- GitHub CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.49% probability of exploitation activity in the next 30 days; percentile 41.

## Sources

- [GitHub Advisory GHSA-wcg9-pgqv-xm5v](https://github.com/advisories/GHSA-wcg9-pgqv-xm5v)
- [CVE.org record CVE-2024-43400](https://www.cve.org/CVERecord?id=CVE-2024-43400)
- [NVD entry CVE-2024-43400](https://nvd.nist.gov/vuln/detail/CVE-2024-43400)
- [github.com](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v)
- [github.com](https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c)
- [jira.xwiki.org](https://jira.xwiki.org/browse/XWIKI-21810)

---
Source page: https://erroneo.us/security/cve/CVE-2024-43400/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt