Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2023-40572

CRITICAL
Published 2023-08-24T01:15:33.272Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2023-40572. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
9.1
/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.018
probability
of exploitation in the wild

There is a 1.8% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.819
Higher than 81.9% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED

Impact Metrics

Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

xwiki

xwiki-platform

Affected Versions:

>= 3.2-milestone-3, < 14.10.9 >= 15.0-rc-1, < 15.4-rc-1

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action

GHSA-4f8m-7h83-9f6m

Advisory Details

### Impact The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. To reproduce, the XWiki syntax `[[image:path:/xwiki/bin/create/Foo/WebHome?template=&parent=Main.WebHome&title=$services.logging.getLogger(%22foo%22).error(%22Script%20executed!%22)]]` can be added to any place that supports XWiki syntax like a comment. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. ### Patches This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation. ### Workarounds There are no known workarounds. ### References * https://jira.xwiki.org/browse/XWIKI-20849 * https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7

Affected Packages

Maven org.xwiki.platform:xwiki-platform-oldcore
ECOSYSTEM: ≥3.2-milestone-3 <14.10.9
Maven org.xwiki.platform:xwiki-platform-oldcore
ECOSYSTEM: ≥15.0-rc-1 <15.4-rc-1

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

WEB https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-40572
WEB https://github.com/xwiki/xwiki-platform/commit/123e5d7e4ca06bf75b95aaef665aafc4fa9cae64
WEB https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7
PACKAGE https://github.com/xwiki/xwiki-platform
WEB https://jira.xwiki.org/browse/XWIKI-20849

Advisory provided by GitHub Security Advisory Database. Published: August 23, 2023, Modified: September 1, 2023

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m
https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7
https://jira.xwiki.org/browse/XWIKI-20849
Published: 2023-08-24T01:15:33.272Z
Last Modified: 2024-10-02T20:19:27.637Z
Copied to clipboard!