Skip to content
Fencer Vulns
critical 9.1

CVE-2023-22457 in the critical feed json

org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery

published 2023-01-04 3 y ago modified 2026-09-10 1 mo ago also GHSA-6mjp-2rm6-9g85 , EUVD-2023-0368

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
19.3%
EPSS 19.3% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the current user. If a privileged user with programming rights was tricked into executing a GET request to this document with certain parameters (e.g., via an image with a corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code execution and the attacker could gain rights, access private information or impact the availability of the wiki. The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1. There are no known workarounds for this other than upgrading the CKEditor integration to a fixed version.

Patch / fix

  • maven org.xwiki.contrib:application-ckeditor-ui 1.64.3
  • xwiki ckeditor_integration 1.64.3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-22457 updated cvss 8.0

CKEditor: Cross-Site Request Forgery (CSRF) in HTMLConverter

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

19.28% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/xwiki-contrib/application-ckeditor/security/advisories/GHSA-6mjp-2rm6-9g85 referenced PoC, tagged "exploit" by a source, unverified
  • jira.xwiki.org https://jira.xwiki.org/browse/CKEDITOR-475 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.xwiki.contrib:application-ckeditor-ui
<1.64.3
1.64.3

Affected products

  • xwiki-contrib application-ckeditor

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.