Vulnerability record · CVE-2023-45138 · published 12 October 2023
CVE-2023-45138: XWiki Change Request script injection via crafted title
Xwiki · Change Request
XWiki Change Request versions 0.11 through 1.9.1 allow a user with no specific rights to inject script through the title field when creating a new Change Request, leading to remote code execution. The flaw is critical because the application is designed to be used by unprivileged users, so the attack path requires no elevated access. It is fixed in 1.9.2.
Description
Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.6 with no privileges required and remote code execution impact, plus very high EPSS, makes this an urgent patch.
What it is
XWiki Change Request versions 0.11 through 1.9.1 allow a user with no specific rights to inject script through the title field when creating a new Change Request, leading to remote code execution. The flaw is critical because the application is designed to be used by unprivileged users, so the attack path requires no elevated access. It is fixed in 1.9.2.
Impact
An attacker gains script injection and remote code execution on the XWiki server, which can lead to full compromise of the wiki and its data.
Attack surface
Reached over the network through the Change Request creation interface by submitting a crafted title; the CVSS vector indicates no privileges required but user interaction is required, likely a victim viewing the malicious request.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged, but EPSS is very high at 0.71 (99th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade Change Request to version 1.9.2 or later.
- If upgrading is not possible, edit the document ChangeRequest.Code.ChangeRequestSheet and apply the same change as the fix commit.
- Restrict or monitor who can create Change Requests until patched.
- Review XWiki logs for suspicious Change Request titles containing script or template syntax.
Detection
- Search XWiki Change Request titles for script tags, template expressions, or other injection payloads.
- Monitor server-side process execution and unexpected child processes spawned by the XWiki application.
- Alert on Change Request creation events from users with no prior activity or unusual titles.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/xwiki-contrib/application-changerequest/commit/7565e720117f73102f5a276239eabfe85e15cff4 | Patch |
| https://github.com/xwiki-contrib/application-changerequest/security/advisories/GHSA-f776-w9v2-7vfj | Vendor Advisory |
| https://jira.xwiki.org/browse/CRAPP-298 | Issue TrackingThird Party Advisory |
| https://github.com/xwiki-contrib/application-changerequest/commit/7565e720117f73102f5a276239eabfe85e15cff4 | Patch |
| https://github.com/xwiki-contrib/application-changerequest/security/advisories/GHSA-f776-w9v2-7vfj | Vendor Advisory |
| https://jira.xwiki.org/browse/CRAPP-298 | Issue TrackingThird Party Advisory |
Track CVE-2023-45138 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-45138), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
