{"action":"Upgrade org.xwiki.contrib.changerequest:application-changerequest-ui to 1.9.2 or later.","affected":[{"fixed":"1.9.2","introduced":"0.11"}],"component":"org.xwiki.contrib.changerequest:application-changerequest-ui","cve_ids":["CVE-2023-45138"],"ecosystem":"Maven","epss":0.71744,"exploited":false,"fixed_versions":["1.9.2"],"ghsa_id":"GHSA-f776-w9v2-7vfj","id":"tcs_01M5N8VCD1F92HVQRN168S2B7P","modified_at":"2023-11-08T04:13:37.197628Z","published_at":"2023-10-17T02:19:16Z","references":["https://osv.dev/vulnerability/GHSA-f776-w9v2-7vfj","https://github.com/xwiki-contrib/application-changerequest/security/advisories/GHSA-f776-w9v2-7vfj","https://nvd.nist.gov/vuln/detail/CVE-2023-45138","https://github.com/xwiki-contrib/application-changerequest/commit/7565e720117f73102f5a276239eabfe85e15cff4","https://github.com/xwiki-contrib/application-changerequest","https://jira.xwiki.org/browse/CRAPP-298"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-f776-w9v2-7vfj","url":"https://osv.dev/vulnerability/GHSA-f776-w9v2-7vfj"}],"summary":"XWiki Change Request Application UI XSS and remote code execution through change request title"}