Maven/com.xpn.xwiki.platform.plugins:xwiki-plugin-scheduler CVE-2023-40573: critical 9, EPSS 1.08%
XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-8xhr-x3v8-rghj#Maven/com.xpn.xwiki.platform.plugins:xwiki-plugin-scheduler
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8xhr-x3v8-rghj
- https://nvd.nist.gov/vuln/detail/CVE-2023-40573
- https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-20852
CVE-2023-40573 · published · modified · JSON