CVE-2023-40572

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.0:rc1:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.1:-:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.1:rc1:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.2:-:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.2:rc1:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.3:-:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.3:rc1:*:*:*:*:*:*

History

01 Sep 2023, 17:07

Type Values Removed Values Added
First Time Xwiki xwiki
Xwiki
CPE cpe:2.3:a:xwiki:xwiki:15.2:-:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.3:rc1:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.2:rc1:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.1:rc1:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.3:-:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.0:rc1:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:15.1:-:*:*:*:*:*:*
References (MISC) https://jira.xwiki.org/browse/XWIKI-20849 - (MISC) https://jira.xwiki.org/browse/XWIKI-20849 - Exploit, Issue Tracking, Vendor Advisory
References (MISC) https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m - (MISC) https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m - Patch, Vendor Advisory
References (MISC) https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7 - (MISC) https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7 - Patch
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.0

24 Aug 2023, 02:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-08-24 02:15

Updated : 2024-02-28 20:33


NVD link : CVE-2023-40572

Mitre link : CVE-2023-40572

CVE.ORG link : CVE-2023-40572


JSON object : View

Products Affected

xwiki

  • xwiki
CWE
CWE-352

Cross-Site Request Forgery (CSRF)