CVE-2023-45138
CriticalXWiki Change Request Application UI XSS and remote code execution through change request title
Published Oct 17, 2023 · Updated Aug 12, 2026 · Also known as GHSA-f776-w9v2-7vfj
Key Facts
Patch immediately- CVE-2023-45138 is a critical-severity vulnerability (CVSS 9.6 v3.1) affecting Change Request (Xwiki), org.xwiki.contrib.changerequest:application-changerequest-ui (maven), application-changerequest.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 72% probability of exploitation in the next 30 days.
- Fixed versions are available, including org.xwiki.contrib.changerequest:application-changerequest-ui 1.9.2, Change Request 1.9.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
72%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2023-45138 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document ChangeRequest.Code.ChangeRequestSheet and by performing the same change as in the fix commit.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Change RequestXwiki | See advisory | 1.9.2 |
| org.xwiki.contrib.changerequest:application-changerequest-uimaven | >= 0.11 | 1.9.2 |
| application-changerequest | >= >= 0.11, < 1.9.2 | n/a |
Patched Releases
org.xwiki.contrib.changerequest:application-changerequest-ui
1.9.2
Change Request
1.9.2
Timeline
Publicly disclosed
Oct 17, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45138.json
- advisoryhttps://github.com/xwiki-contrib/application-changerequest/security/advisories/GHSA-f776-w9v2-7vfj
- advisoryhttps://jira.xwiki.org/browse/CRAPP-298
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-45138
FAQ
Common Questions.
Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.
Affected: Change Request (Xwiki); org.xwiki.contrib.changerequest:application-changerequest-ui (maven) versions >= 0.11; application-changerequest versions >= >= 0.11, < 1.9.2. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including org.xwiki.contrib.changerequest:application-changerequest-ui 1.9.2, Change Request 1.9.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2023-45138 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo