CVE-2024-43401: 
Java vulnerability analysis and mitigation

CVE-2024-43401 affects XWiki Platform, a generic wiki platform offering runtime services for applications. The vulnerability allows a user without script/programming rights to trick users with elevated privileges into executing malicious payloads through the WYSIWYG editor. The vulnerability was discovered in August 2024 and affects all versions up to XWiki 15.9, with a patch released in XWiki 15.10RC1 (NVD, GitHub Advisory).

The vulnerability stems from a missing authorization check when users with elevated rights edit content containing malicious payloads. The CVSS v3.1 score is 8.0 HIGH according to NVD and 9.0 CRITICAL according to GitHub, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The vulnerability is classified under CWE-862 (Missing Authorization) and CWE-269 (Improper Privilege Management) (NVD).

When exploited, this vulnerability allows attackers to execute arbitrary code in the context of privileged users when they edit content containing malicious payloads. This can lead to complete compromise of the system's confidentiality, integrity, and availability through the execution of unauthorized scripts (GitHub Advisory).

The vulnerability can be exploited by users without script/programming rights by inserting malicious payloads into content that will be edited by users with elevated privileges. The payload executes automatically when the privileged user opens the content for editing in the WYSIWYG editor, without any warning about the dangerous content (NVD).

The vulnerability has been patched in XWiki 15.10RC1. No workarounds are available, and users are strongly advised to upgrade to XWiki 15.10 or later versions (GitHub Advisory).