{"id":"CVE-2024-21651","published":"2024-01-08T23:30:03Z","modified":"2025-06-03T14:34:29Z","title":"XWiki Denial of Service attack through attachments","vendor":"xwiki","product":"xwiki-platform","tier":"tail","description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00636,"percentile":0.50326,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8959-rfxh-r4j4","tags":["x_refsource_CONFIRM"]},{"url":"https://jira.xwiki.org/browse/XCOMMONS-2796","tags":["x_refsource_MISC"]}],"priority":{"score":15.3,"factors":[{"name":"EPSS percentile","points":10.07},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"xwiki","affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 14.10, < 14.10.18",">= 15.0-rc-1, < 15.5.3",">= 15.6-rc-1, < 15.8-rc-1"]}],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=14.10, <14.10.18",">=15.0-rc-1, <15.5.3",">=15.6-rc-1, <15.8-rc-1"],"patched":["14.10.18","15.5.3","15.8-rc-1"],"from":["GHSA-8959-rfxh-r4j4"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0294","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-55663","published":"2024-12-12","fixed":"14.3-rc-1","kev":false},{"cve":"CVE-2023-29525","published":"2023-04-18","fixed":"14.6-rc-1","kev":false},{"cve":"CVE-2023-32071","published":"2023-05-09","fixed":"14.10.4","kev":false,"link":{"from":"CVE-2023-32071","to":"CVE-2024-21651","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-distribution-war","fromFixed":"14.10.4","toFixed":"14.10.18","daysApart":244}]}},{"cve":"CVE-2024-21651","published":"2024-01-08","fixed":"15.8-rc-1","kev":false},{"cve":"CVE-2025-32429","published":"2025-07-24","fixed":"17.3.0-rc-1","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-distribution-war"}}