XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks

CVE-2023-48292

What is CVE-2023-48292?

The XWiki Admin Tools Application has a cross-site request forgery vulnerability, enabling attackers to execute arbitrary shell commands on the server. This is achieved by causing an admin user to load a malicious URL embedded in comments. When the harmful comment is viewed, it can result in the unintended execution of commands, compromising both the integrity and confidentiality of the XWiki installation. A patch for this issue has been released in version 4.5.1, which incorporates a form token check to mitigate the risk. As a precaution, admins are advised to either apply the patch or remove the vulnerability-prone command execution functionality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References