{"action":"Upgrade com.xwiki.identity-oauth:identity-oauth-ui to 1.6 or later.","affected":[{"fixed":"1.6","introduced":"1.0"}],"component":"com.xwiki.identity-oauth:identity-oauth-ui","cve_ids":["CVE-2023-45144"],"ecosystem":"Maven","epss":0.01235,"exploited":false,"fixed_versions":["1.6"],"ghsa_id":"GHSA-h2rm-29ch-wfmh","id":"tcs_01M5N8ZDRFZPSH9HAFX2V6ZD26","modified_at":"2023-11-08T04:13:37.383140Z","published_at":"2023-10-17T12:51:01Z","references":["https://osv.dev/vulnerability/GHSA-h2rm-29ch-wfmh","https://github.com/xwikisas/identity-oauth/security/advisories/GHSA-h2rm-29ch-wfmh","https://nvd.nist.gov/vuln/detail/CVE-2023-45144","https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6","https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6#diff-2ab2e0716443d790d7d798320e4a45151661f4eca5440331f4a227b29c87c188","https://github.com/xwikisas/identity-oauth","https://github.com/xwikisas/identity-oauth/blob/master/ui/src/main/resources/IdentityOAuth/LoginUIExtension.vm#L58","https://jira.xwiki.org/browse/XWIKI-20719"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-h2rm-29ch-wfmh","url":"https://osv.dev/vulnerability/GHSA-h2rm-29ch-wfmh"}],"summary":"XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter"}