CVE-2023-45138 Change Request Application vulnerable to XSS and remote code execution through change request title

What is CVE-2023-45138?

CVE-2023-45138 is a critical cross-site scripting vulnerability in xwiki-contrib application-changerequest, published on 12 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit.

Weakness: CWE-79

Which versions are affected by CVE-2023-45138?

2 open source packages ship an affected version, including org.xwiki.contrib.changerequest:application-changerequest-ui. It affects 1 product.

Products include Xwiki Change Request.

How do I fix CVE-2023-45138?

Upgrade org.xwiki.contrib.changerequest:application-changerequest-ui to 1.9.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-45138 being exploited?

There is no known exploitation of CVE-2023-45138 in the wild and no public exploit code.

Other vulnerabilities in xwiki-contrib application-changerequest

• CVE-2023-49280 Data leak of password hash through xwiki change request High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f776-w9v2-7vfj.