What is CVE-2023-37277?

CVE-2023-37277 is a critical-severity vulnerability in Xwiki, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.6/10. Published 2023-07-10.

How severe is CVE-2023-37277?

Critical severity. CVSS v3 base score is 9.6 out of 10.

CSRF in Xwiki

CVE-2023-37277

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipart/form-data` or `application/www-form-urlencoded` as content types which can be sent via regular HTML forms, thus allowing cross-site request forgery. With the interaction of a user with programming rights, this allows remote code execution through script macros and thus impacts the integrity, availability and confidentiality of the whole XWiki installation. For regular cookie-based authentication, the vulnerability is mitigated by SameSite cookie restrictions but as of March 2023, these are not enabled by default in Firefox and Safari. The vulnerability has been patched in XWiki 14.10.8 and 15.2 by requiring a CSRF token header for certain request types that are susceptible to CSRF attacks.

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2023-07-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.007 (50.3th percentile), scored 2026-10-07.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 50.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000

Affected products

Xwiki
Xwiki Xwiki-Platform — versions >= 1.8, < 14.10.8, >= 15.0-rc-1, < 15.2

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

github.com/xwiki/xwiki-platform/security/advisories/GHSA-6xxr-648m-gch6 (Patch, Vendor Advisory)
github.com/xwiki/xwiki-platform/commit/4c175405faa0e62437df397811c7526dfc0fbae7 (Patch)
jira.xwiki.org/browse/XWIKI-20135 (Patch, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2023-37277?: CVE-2023-37277 is a critical-severity vulnerability in Xwiki, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.6/10. Published 2023-07-10.
How severe is CVE-2023-37277?: Critical severity. CVSS v3 base score is 9.6 out of 10.