9

CVE-2023-40572

Exploit

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.

Data is provided by the National Vulnerability Database (NVD)
Xwiki ≫ Xwiki Version < 14.10.9
Xwiki ≫ Xwiki Version15.0 Update-
Xwiki ≫ Xwiki Version15.0 Updaterc1
Xwiki ≫ Xwiki Version15.1 Update-
Xwiki ≫ Xwiki Version15.1 Updaterc1
Xwiki ≫ Xwiki Version15.2 Update-
Xwiki ≫ Xwiki Version15.2 Updaterc1
Xwiki ≫ Xwiki Version15.3 Update-
Xwiki ≫ Xwiki Version15.3 Updaterc1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.8% 0.817
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8 2.1 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
security-advisories@github.com 9 2.3 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://jira.xwiki.org/browse/XWIKI-20849
Vendor Advisory
Exploit
Issue Tracking