CVE-2025-24017

YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki's pages which is triggered when a user clicks on a malicious link. The vulnerability makes use of the search by tag feature. When a tag doesn't exist, the tag is reflected on the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client's side when clicked. This vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b	Patch
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wphc-5f2j-jhvg	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-01-21 16:15

Updated : 2025-05-09 14:05

NVD link : CVE-2025-24017

Mitre link : CVE-2025-24017

CVE.ORG link : CVE-2025-24017

JSON object : View

Products Affected

yeswiki

yeswiki

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-24017", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-01-21T16:15:15.087", "references": [{"url": "https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wphc-5f2j-jhvg", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki's pages which is triggered when a user clicks on a malicious link. The vulnerability makes use of the search by tag feature. When a tag doesn't exist, the tag is reflected on the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client's side when clicked. This vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue."}, {"lang": "es", "value": "YesWiki es una wiki sistema escrita en PHP. Las versiones hasta incluida 4.4.5 son vulnerables a que cualquier usuario final manipule un XSS basado en DOM en todas las p\u00e1ginas de YesWiki que se active cuando un usuario haga clic en un enlace malicioso. La vulnerabilidad hace uso de la funci\u00f3n de b\u00fasqueda por etiqueta. Cuando una etiqueta no existe, la etiqueta se refleja en la p\u00e1gina y no se desinfecta correctamente en el lado del servidor, lo que permite a un usuario malicioso generar un enlace que activar\u00e1 un XSS en el lado del cliente cuando se haga clic en \u00e9l. Esta vulnerabilidad permite a cualquier usuario generar un enlace malicioso que activar\u00e1 una apropiaci\u00f3n de cuenta cuando se haga clic en \u00e9l, lo que permite a un usuario robar otras cuentas, modificar p\u00e1ginas, comentarios, permisos, extraer datos de usuario (correos electr\u00f3nicos), lo que afecta la integridad, disponibilidad y confidencialidad de una instancia de YesWiki. La versi\u00f3n 4.5.0 contiene un parche para el problema."}], "lastModified": "2025-05-09T14:05:15.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73A9706C-A5C2-4B1E-91E9-08C65D4B41C9", "versionEndExcluding": "4.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}