Maven/org.xwiki.platform:xwiki-platform-scheduler-api CVE-2023-40573: critical 9, EPSS 1.08%
XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution
Action: Upgrade org.xwiki.platform:xwiki-platform-scheduler-api to 14.10.9 (14.x) or 15.4-rc-1 (15.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 14.10.9 | - |
| 15.0-rc-1 | 15.4-rc-1 | - |
Fixed versions
| 14.10.9 | 15.4-rc-1 |
Sources
- osv: GHSA-8xhr-x3v8-rghj
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8xhr-x3v8-rghj
- https://nvd.nist.gov/vuln/detail/CVE-2023-40573
- https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-20852
CVE-2023-40573 · published · modified · JSON