{"id":"CVE-2024-46979","aliases":["GHSA-pg4m-3gp6-hw4w"],"url":"https://o3.security/vulnerability/CVE-2024-46979","summary":"Data leak of notification filters of users in XWiki Platform","details":"### Impact\n\nIt's possible to get access to notification filters of any user by using a URL such as `<hostname>xwiki/bin/get/XWiki/Notifications/Code/NotificationFilterPreferenceLivetableResults?outputSyntax=plain&type=custom&user=<username>`. This vulnerability impacts all versions of XWiki since 13.2-rc-1.\nThe filters do not provide much information (they mainly contain references which are public data in XWiki), though some info could be used in combination with other vulnerabilities.\n\n### Patches\n\nThe vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0RC1. \nThe patch consists in checking the rights of the user when sending the data.\n\n### Workarounds\n\nIt's possible to workaround the vulnerability by applying manually the patch: it's possible for an administrator to edit directly the document `XWiki.Notifications.Code.NotificationFilterPreferenceLivetableResults` to apply the same changes as in the patch. See c8c6545f9bde6f5aade994aa5b5903a67b5c2582.\n\n### References\n\n  * Jira ticket: https://jira.xwiki.org/browse/XWIKI-20336\n  * Commit: c8c6545f9bde6f5aade994aa5b5903a67b5c2582\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThis vulnerability has been reported on Intigriti by [Mete](https://www.linkedin.com/in/metehan-kalkan-5a3201199).","published":"2024-09-18T17:23:34.839Z","modified":"2026-08-12T03:51:33.645956281Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-notifications-ui","fixedVersion":"14.10.21"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-notifications-ui","fixedVersion":"15.5.5"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-notifications-ui","fixedVersion":"15.10.1"}],"fix":{"url":"https://github.com/xwiki/xwiki-platform/commit/c8c6545f9bde6f5aade994aa5b5903a67b5c2582","label":"xwiki/xwiki-platform@c8c6545"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20336"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46979.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pg4m-3gp6-hw4w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46979"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/c8c6545f9bde6f5aade994aa5b5903a67b5c2582"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/29e5edbb2b7068ada17290cea41e0aa8144e1294"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/a0352922a1a61e0e858a9be89d73f0665630a63a"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/ed090d1aa228848d3860968c437b72db3b09119f"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:33.645956281Z"}}