org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery
CVE-2023-22457

9.1CRITICAL

Key Information:

Vendor: Xwiki-contrib
Status: Application-ckeditor
Vendor: CVE Published:; 4 January 2023

🔔 Create Xwiki-contrib Vulnerability Alert

What is CVE-2023-22457?

The CKEditor Integration for XWiki was found to lack adequate protection against Cross-Site Request Forgery (CSRF). This vulnerability could allow an attacker to execute macros with the privileges of a current user if they deceive a privileged user with programming rights into making a malicious GET request. By embedding certain parameters into an image URL or through redirection, the attacker could gain unauthorized access to sensitive information, manipulate the wiki content, or disrupt service availability. The issue has been addressed in CKEditor Integration version 1.64.3, and users are advised to upgrade to this version or later to mitigate the risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch