Log in Start free

Vulnerability · Published Oct 16, 2023 · Assigned by GitHub_M

CVE-2023-45144Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

Critical 10.0

In plain English

A critical-severity cross-site scripting in identity-oauth from xwikisas. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)1.2%top 30.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavencom.xwiki.identity-oauth:identity-oauth-ui1.6GHSA-h2rm-29ch-wfmh

Affected products (as reported)

VendorProductVersions
xwikisas identity-oauth >= 1.0, < 1.6

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References