CVE-2023-45144
1 advisory.
Maven/com.xwiki.identity-oauth:identity-oauth-ui CVE-2023-45144: critical 10
XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter
Action: Upgrade com.xwiki.identity-oauth:identity-oauth-ui to 1.6 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0 | 1.6 | - |
Fixed versions
| 1.6 |
Sources
- osv: GHSA-h2rm-29ch-wfmh
- https://github.com/xwikisas/identity-oauth/security/advisories/GHSA-h2rm-29ch-wfmh
- https://nvd.nist.gov/vuln/detail/CVE-2023-45144
- https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6
- https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6#diff-2ab2e0716443d790d7d798320e4a45151661f4eca5440331f4a227b29c87c188
- https://github.com/xwikisas/identity-oauth
- https://github.com/xwikisas/identity-oauth/blob/master/ui/src/main/resources/IdentityOAuth/LoginUIExtension.vm#L58
- https://jira.xwiki.org/browse/XWIKI-20719
CVE-2023-45144 · published · modified · JSON