{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45910?format=json","vulnerability_id":"VCID-3gjp-eske-eqgk","summary":"Cross-Site Request Forgery (CSRF)\nXWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.","aliases":[{"alias":"CVE-2023-40572"},{"alias":"GHSA-4f8m-7h83-9f6m"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/66636?format=json","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@14.10.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@14.10.9"},{"url":"http://public2.vulnerablecode.io/api/packages/66637?format=json","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.4-rc-1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.4-rc-1"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65729?format=json","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@3.2-milestone-3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3gjp-eske-eqgk"},{"vulnerability":"VCID-k3dm-pjf6-p3b8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@3.2-milestone-3"},{"url":"http://public2.vulnerablecode.io/api/packages/65815?format=json","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.0-rc-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1x2u-ggpt-q7br"},{"vulnerability":"VCID-3gjp-eske-eqgk"},{"vulnerability":"VCID-9649-wpan-ykaq"},{"vulnerability":"VCID-by7h-2wyg-jqfy"},{"vulnerability":"VCID-rmg4-3gqx-duc6"},{"vulnerability":"VCID-rpvk-g9y1-yucv"},{"vulnerability":"VCID-xevu-xntb-vufs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.0-rc-1"}],"references":[{"reference_url":"https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7"},{"reference_url":"https://jira.xwiki.org/browse/XWIKI-20849","reference_id":"","reference_type":"","scores":[],"url":"https://jira.xwiki.org/browse/XWIKI-20849"},{"reference_url":"https://github.com/advisories/GHSA-4f8m-7h83-9f6m","reference_id":"GHSA-4f8m-7h83-9f6m","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-4f8m-7h83-9f6m"},{"reference_url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m","reference_id":"GHSA-4f8m-7h83-9f6m","reference_type":"","scores":[],"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":352,"name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."}],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3gjp-eske-eqgk"}