CVE-2023-48293

{"id": "CVE-2023-48293", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-11-20T19:15:08.870", "references": [{"url": "https://github.com/xwiki-contrib/application-admintools/commit/45298b4fbcafba6914537dcdd798a1e1385f9e46", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-4f4c-rhjv-4wgv", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://jira.xwiki.org/browse/ADMINTOOL-92", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allows modifying and deleting all data of the wiki. This could be both used to damage the wiki and to create an account with elevated privileges for the attacker, thus impacting the confidentiality, integrity and availability of the whole XWiki instance. A possible attack vector are comments on the wiki, by embedding an image with wiki syntax like `[[image:path:/xwiki/bin/view/Admin/QueryOnXWiki?query=DELETE%20FROM%20xwikidoc]]`, all documents would be deleted from the database when an admin user views this comment. This has been patched in Admin Tools Application 4.5.1 by adding form token checks. Some workarounds are available. The patch can also be applied manually to the affected pages. Alternatively, if the query tool is not needed, by deleting the document `Admin.SQLToolsGroovy`, all database query tools can be deactivated."}, {"lang": "es", "value": "XWiki Admin Tools Application proporciona herramientas para ayudar en la administraci\u00f3n de XWiki. Antes de la versi\u00f3n 4.5.1, una vulnerabilidad de Cross-Site Request Forgery en la herramienta de consulta en XWiki permit\u00eda ejecutar consultas arbitrarias en la base de datos de la instalaci\u00f3n de XWiki. Entre otras cosas, esto permite modificar y eliminar todos los datos de la wiki. Esto podr\u00eda usarse tanto para da\u00f1ar el wiki como para crear una cuenta con privilegios elevados para el atacante, impactando as\u00ed la confidencialidad, integridad y disponibilidad de toda la instancia de XWiki. Un posible vector de ataque son los comentarios en la wiki, al incrustar una imagen con sintaxis de wiki como `[[image:path:/xwiki/bin/view/Admin/QueryOnXWiki?query=DELETE%20FROM%20xwikidoc]]`, todos los documentos se eliminar\u00e1 de la base de datos cuando un usuario administrador vea este comentario. Esto se ha solucionado en la aplicaci\u00f3n Admin Tools 4.5.1 a\u00f1adiendo comprobaciones de tokens de formulario. Algunos workarounds est\u00e1n disponibles. El parche tambi\u00e9n se puede aplicar manualmente a las p\u00e1ginas afectadas. Alternativamente, si la herramienta de consulta no es necesaria, al eliminar el documento `Admin.SQLToolsGroovy`, se pueden desactivar todas las herramientas de consulta de la base de datos."}], "lastModified": "2023-11-29T18:02:07.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94575ED9-1677-4701-8C80-6E435C9B1850", "versionEndExcluding": "4.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}