{"action":"Upgrade org.xwiki.platform:xwiki-platform-web-war to 14.10.21 (14.10.x), 15.5.5 (15.5.x), 15.10.6 (15.10.x) or 16.0.0 (16.0.x) or later.","affected":[{"fixed":"14.10.21","introduced":"4.2-milestone-3"},{"fixed":"15.5.5","introduced":"15.0-rc-1"},{"fixed":"15.10.6","introduced":"15.6-rc-1"},{"fixed":"16.0.0","introduced":"16.0.0-rc-1"}],"component":"org.xwiki.platform:xwiki-platform-web-war","cve_ids":["CVE-2024-37900"],"ecosystem":"Maven","epss":0.15804,"exploited":false,"fixed_versions":["14.10.21","15.5.5","15.10.6","16.0.0"],"ghsa_id":"GHSA-wf3x-jccf-5g5g","id":"tcs_01M5N9G69BMQWX40DQ3N0DWW0T","modified_at":"2024-11-18T16:26:57Z","published_at":"2024-07-31T15:21:06Z","references":["https://osv.dev/vulnerability/GHSA-wf3x-jccf-5g5g","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wf3x-jccf-5g5g","https://nvd.nist.gov/vuln/detail/CVE-2024-37900","https://github.com/xwiki/xwiki-platform/commit/6cdd69d31d6bf3caa7f40ec55eb317e4e528ad28","https://github.com/xwiki/xwiki-platform/commit/8b8a2d80529b9a9c038014c1eb6c2adc08069dfd","https://github.com/xwiki/xwiki-platform/commit/910a5018a50039e8b24556573dfe342f143ef949","https://github.com/xwiki/xwiki-platform/commit/9df46f8e5313af46f93bccd1ebc682e28126573f","https://github.com/xwiki/xwiki-platform","https://jira.xwiki.org/browse/XWIKI-19602","https://jira.xwiki.org/browse/XWIKI-19611","https://jira.xwiki.org/browse/XWIKI-21769"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-wf3x-jccf-5g5g","url":"https://osv.dev/vulnerability/GHSA-wf3x-jccf-5g5g"}],"summary":"XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader"}