CVE-2024-21648
Xwiki ≤ 14.10.17
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-21648 is a high-severity Improper Handling of Insufficient Privileges (CWE-274) vulnerability in Xwiki Xwiki. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0458
Vulnerability Data
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they…
more
don't have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Always-invoked reference monitor guarantees privilege checks occur and cannot be bypassed or mishandled.
Enforces approved authorizations so insufficient privileges produce a proper denial instead of mishandled failure.
Requires every access request to be decided against current authorizations, preventing ad-hoc privilege handling.
Least-privilege assignment reduces the frequency of operations that encounter insufficient privileges.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege access policies directly prevents improper handling of insufficient privileges.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires defining a topic-specific access control policy and determining requirements; it does not itself enforce authorizations or handle insufficient-privilege cases at runtime, so the weakness can still be exploited (per the owner's labeling rule: policy/dependency controls do not prevent unless other controls act on them).
Access-rights provisioning and review reduce privilege gaps, yet do not address the software’s failure to handle insufficient privileges gracefully.
Privileged-access-rights control directly limits the situations in which insufficient privileges can occur.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 9 (2 rules)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. blocks CWE-274
- V-271640 OL 9 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS. blocks CWE-274
RHEL 9 (1 rule)
- V-258078 RHEL 9 must use a Linux Security Module configured to enforce limits on system services. blocks CWE-274