Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2023-37277

kritisch

CVE-2023-37277

XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API

Veröffentlicht Geändert CWE 352
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GHSA9.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA.

Beschreibung

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipart/form-data` or `application/www-form-urlencoded` as content types which can be sent via regular HTML forms, thus allowing cross-site request forgery. With the interaction of a user with programming rights, this allows remote code execution through script macros and thus impacts the integrity, availability and confidentiality of the whole XWiki installation. For regular cookie-based authentication, the vulnerability is mitigated by SameSite cookie restrictions but as of March 2023, these are not enabled by default in Firefox and Safari. The vulnerability has been patched in XWiki 14.10.8 and 15.2 by requiring a CSRF token header for certain request types that are susceptible to CSRF attacks.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
maven::GitHub Security Advisory Mavencom.xpn.xwiki.platform:xwiki-core-rest-server, com.xpn.xwiki.platform:xwiki-rest, org.xwiki.platform:xwiki-platform-rest-server14.10.8 und 1 weitere
Alle 3 Einträge aus 1 Quelle zeigen
QuellePaketBehoben in
maven::GitHub Security Advisory Mavencom.xpn.xwiki.platform:xwiki-core-rest-server14.10.8
maven::GitHub Security Advisory Mavencom.xpn.xwiki.platform:xwiki-rest14.10.8
maven::GitHub Security Advisory Mavenorg.xwiki.platform:xwiki-platform-rest-server14.10.8, 15.2

Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.