Executive Summary

Informations
Name CVE-2023-40573 First vendor Publication 2023-08-24
Vendor Cve Last vendor Modification 2023-09-01

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score 8.8
Base Score 8.8 Environmental Score 8.8
impact SubScore 5.9 Temporal Score 8.8
Exploitabality Sub Score 2.8
 
Attack Vector Network Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki. If the attack is successful, an error log entry with "Job content executed" will be produced. This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40573

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 106

Sources (Detail)

Source Url
MISC https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a...
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8xhr-x3v8-rghj
https://jira.xwiki.org/browse/XWIKI-20852

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
Date Informations
2024-09-07 02:41:49
  • Multiple Updates
2024-08-02 13:50:58
  • Multiple Updates
2024-08-02 01:33:48
  • Multiple Updates
2024-02-02 02:48:01
  • Multiple Updates
2024-02-01 12:30:53
  • Multiple Updates
2023-11-30 02:33:08
  • Multiple Updates
2023-11-03 02:40:23
  • Multiple Updates
2023-11-01 02:33:37
  • Multiple Updates
2023-09-30 13:29:42
  • Multiple Updates
2023-09-05 05:27:29
  • Multiple Updates
2023-09-05 01:29:49
  • Multiple Updates
2023-09-01 21:27:31
  • Multiple Updates
2023-08-25 02:28:58
  • Multiple Updates
2023-08-25 02:28:53
  • Multiple Updates
2023-08-24 17:27:18
  • Multiple Updates
2023-08-24 09:27:17
  • First insertion