CVE-2023-40572
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
XWiki Platform is vulnerable to a CSRF attack in the create action, allowing remote code execution by users with appropriate permissions. If a user with script rights sees a specific log message, the XWiki installation is at risk.
Risk Assessment
An attacker could gain access to sensitive data and compromise the integrity and availability of the entire XWiki installation. This poses a serious security threat to the organization.
Recommendation
It is recommended to upgrade to XWiki version 14.10.9 or 15.4RC1, which include a fix requiring a CSRF token for page creation.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.