RCE in Xwiki Oauth Identity
CVE-2023-45144
com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.011 (61.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Xwiki Oauth_identity
- Xwikisas Identity-oauth — versions >= 1.0, < 1.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Broken Link)
- security-advisories@github.com (Permissions Required, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-45144?
- CVE-2023-45144 is a critical-severity vulnerability in Xwiki Oauth Identity, classified under Cross-site Scripting. CVSS score: 10.0/10. Published 2023-10-16.
- How severe is CVE-2023-45144?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2023-45144 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.