What is GHSA-h2rm-29ch-wfmh?

GHSA-h2rm-29ch-wfmh is a security advisory published by GitHub Security Advisories with Critical severity. XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter

Which CVE IDs does GHSA-h2rm-29ch-wfmh cover?

GHSA-h2rm-29ch-wfmh covers the following CVE IDs: CVE-2023-45144. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h2rm-29ch-wfmh?

GHSA-h2rm-29ch-wfmh has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

Which products are affected by GHSA-h2rm-29ch-wfmh?

GHSA-h2rm-29ch-wfmh affects 1 product, including: maven/com.xwiki.identity-oauth:identity-oauth-ui:\u003e= 1.0, \u003c 1.6.

GHSA-h2rm-29ch-wfmhCriticalCVSS 10.0

XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter

Vendor

GitHub Security Advisories

Published

October 17, 2023

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-45144 →

📋 Description

Impact

When login via the OAuth method, the identityOAuth parameters, sent in a GET request is vulnerable to XSS and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation.

The vulnerability is in this part of the code.

Patches

The issue has been fixed in Identity OAuth version 1.6 by https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6 . The fix is in the content of the IdentityOAuth/LoginUIExtension file

Workarounds

There are no known workarounds besides upgrading.

References

Are there any links users can visit to find out more?

Original report: https://jira.xwiki.org/browse/XWIKI-20719

🎯 Affected products1

maven/com.xwiki.identity-oauth:identity-oauth-ui:>= 1.0, < 1.6