CVE-2023-45144 json
Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App
published 2023-10-16 3 y ago modified 2026-06-17 4 mo ago also GHSA-h2rm-29ch-wfmh , EUVD-2023-2744
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade.
Patch / fix
- maven com.xwiki.identity-oauth:identity-oauth-ui 1.6
- xwiki oauth_identity 1.6
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.23% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.xwiki.identity-oauth:identity-oauth-ui | >=1.0, <1.6 |
1.6 |
Affected products
- xwikisas identity-oauth
Classification
References
-
github.com
/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6
web, patch
-
github.com
/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6#diff-2ab2e0716443d790d7d798320e4a4515
web, patch
-
github.com
/xwikisas/identity-oauth/security/advisories/GHSA-h2rm-29ch-wfmh
web, vendor-advisory
-
github.com
/xwikisas/identity-oauth/blob/master/ui/src/main/resources/IdentityOAuth/LoginUIExtension.vm#L58
web, broken-link
-
jira.xwiki.org
/browse/XWIKI-20719
web, permissions-required
-
nvd.nist.gov
/vuln/detail/CVE-2023-45144
advisory
-
github.com
/xwikisas/identity-oauth
package
Sources
- CVE List CVE-2023-45144
- GitHub Advisory GHSA-h2rm-29ch-wfmh
- NVD CVE-2023-45144
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.