9

CVE-2023-40572

Exploit

XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xwiki ≫ Xwiki Version < 14.10.9
Xwiki ≫ Xwiki Version15.0 Update-
Xwiki ≫ Xwiki Version15.0 Updaterc1
Xwiki ≫ Xwiki Version15.1 Update-
Xwiki ≫ Xwiki Version15.1 Updaterc1
Xwiki ≫ Xwiki Version15.2 Update-
Xwiki ≫ Xwiki Version15.2 Updaterc1
Xwiki ≫ Xwiki Version15.3 Update-
Xwiki ≫ Xwiki Version15.3 Updaterc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.55% 0.413
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8 2.1 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
security-advisories@github.com 9 2.3 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7
Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m
Patch
Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20849
Vendor Advisory
Exploit
Issue Tracking