{"id":"CVE-2023-40572","published":"2023-08-24T01:15:33Z","modified":"2024-10-02T20:19:27Z","title":"XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action","vendor":"xwiki","product":"xwiki-platform","tier":"tail","description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00619,"percentile":0.49679,"provenance":"source"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20849","tags":["x_refsource_MISC"]}],"priority":{"score":16.3,"factors":[{"name":"EPSS percentile","points":9.94},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"xwiki","affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 3.2-milestone-3, < 14.10.9",">= 15.0-rc-1, < 15.4-rc-1"]}],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","vulnerableRanges":[">=3.2-milestone-3, <14.10.9",">=15.0-rc-1, <15.4-rc-1"],"patched":["14.10.9","15.4-rc-1"],"from":["GHSA-4f8m-7h83-9f6m"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2206","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-46242","published":"2023-11-07","fixed":"15.2-rc-1","kev":false},{"cve":"CVE-2023-46243","published":"2023-11-07","fixed":"15.2-rc-1","kev":false},{"cve":"CVE-2023-37911","published":"2023-10-25","fixed":"15.3-rc-1","kev":false},{"cve":"CVE-2023-40572","published":"2023-08-24","fixed":"15.4-rc-1","kev":false},{"cve":"CVE-2023-41046","published":"2023-09-01","fixed":"15.4-rc-1","kev":false,"link":{"from":"CVE-2023-40572","to":"CVE-2023-41046","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"14.10.9","toFixed":"14.10.10","daysApart":8}]}},{"cve":"CVE-2024-31464","published":"2024-04-10","fixed":"15.9-rc-1","kev":false},{"cve":"CVE-2024-31981","published":"2024-04-10","fixed":"15.10-rc-1","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-oldcore"}}