XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.
References
| Link | Resource |
|---|---|
| https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7 | Patch |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m | Patch Vendor Advisory |
| https://jira.xwiki.org/browse/XWIKI-20849 | Exploit Issue Tracking Vendor Advisory |
| https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7 | Patch |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m | Patch Vendor Advisory |
| https://jira.xwiki.org/browse/XWIKI-20849 | Exploit Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:19
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.0 |
| References | () https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7 - Patch | |
| References | () https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m - Patch, Vendor Advisory | |
| References | () https://jira.xwiki.org/browse/XWIKI-20849 - Exploit, Issue Tracking, Vendor Advisory |
01 Sep 2023, 17:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://jira.xwiki.org/browse/XWIKI-20849 - Exploit, Issue Tracking, Vendor Advisory | |
| References | (MISC) https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m - Patch, Vendor Advisory | |
| References | (MISC) https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
| CPE | cpe:2.3:a:xwiki:xwiki:15.2:-:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:15.3:rc1:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:15.2:rc1:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:15.1:rc1:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:15.3:-:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:15.0:rc1:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:15.1:-:*:*:*:*:*:* |
|
| First Time |
Xwiki xwiki
Xwiki |
24 Aug 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-24 02:15
Updated : 2024-11-21 08:19
NVD link : CVE-2023-40572
Mitre link : CVE-2023-40572
CVE.ORG link : CVE-2023-40572
JSON object : View
Products Affected
xwiki
- xwiki
CWE
CWE-352
Cross-Site Request Forgery (CSRF)