What is CVE-2023-22457?

CVE-2023-22457 is a critical-severity vulnerability in Xwiki Ckeditor Integration, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.0/10. Published 2023-01-04.

How severe is CVE-2023-22457?

Critical severity. CVSS v3 base score is 9.0 out of 10.

CSRF in Xwiki Ckeditor Integration

CVE-2023-22457

CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the current user. If a privileged user with programming rights was tricked into executing a GET request to this document with certain parameters (e.g., via an image with a corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code execution and the attacker could gain rights, access private information or impact the availability of the wiki. The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1. There are no known workarounds for this other than upgrading the CKEditor integration to a fixed version.

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2023-01-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.187 (97.2th percentile), scored 2026-09-30.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.187 · newest: 0.187 · change: 0.000

Affected products

Xwiki Ckeditor Integration
Xwiki-Contrib Application-Ckeditor — versions < 1.64.3

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

github.com/xwiki-contrib/application-ckeditor/security/advisories/GHSA-6mjp-2rm… (Exploit, Patch, Third Party Advisory)
github.com/xwiki-contrib/application-ckeditor/commit/6b1053164386aefc526df7512b… (Patch, Third Party Advisory)
jira.xwiki.org/browse/CKEDITOR-475 (Exploit, Patch, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2023-22457?: CVE-2023-22457 is a critical-severity vulnerability in Xwiki Ckeditor Integration, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.0/10. Published 2023-01-04.
How severe is CVE-2023-22457?: Critical severity. CVSS v3 base score is 9.0 out of 10.