CVE-2023-45144

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-451453.6Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions tCVE-2023-4514610.0XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian seriCVE-2023-451473.1Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic.CVE-2023-451484.3Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could CVE-2023-451494.3Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation pCVE-2023-45155.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: vCVE-2023-451504.3Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validateCVE-2023-451518.8Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attCVE-2023-451522.3Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a CVE-2023-451589.8An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for loggiCVE-2023-451598.41E Client installer can perform arbitrary file deletion on protected files.   A non-privileged user could provide a symbolic link or WindowCVE-2023-45167.8A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to
CVE-2023-45144: Critical severity, CVSS 9.6 | Vulnix