CVE-2023-45138 in the critical feed json
Change Request Application vulnerable to XSS and remote code execution through change request title
published 2023-10-12 3 y ago modified 2026-06-17 4 mo ago also GHSA-f776-w9v2-7vfj , EUVD-2023-2722
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 71.7%
- EPSS 71.7% chance of exploitation in 30 days, percentile 99.4%
- public exploits
- 0
- none known
Summary
Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit.
Patch / fix
- maven org.xwiki.contrib.changerequest:application-changerequest-ui 1.9.2
- xwiki change_request 1.9.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
71.74% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.contrib.changerequest:application-changerequest-ui | >=0.11, <1.9.2 |
1.9.2 |
Affected products
- xwiki-contrib application-changerequest
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/xwiki-contrib/application-changerequest/commit/7565e720117f73102f5a276239eabfe85e15cff4
web, patch
-
github.com
/xwiki-contrib/application-changerequest/security/advisories/GHSA-f776-w9v2-7vfj
web, vendor-advisory
-
jira.xwiki.org
/browse/CRAPP-298
web, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-45138
advisory
-
github.com
/xwiki-contrib/application-changerequest
package
Sources
- CVE List CVE-2023-45138
- GitHub Advisory GHSA-f776-w9v2-7vfj
- NVD CVE-2023-45138
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.