CVE-2023-48292Admin Tools CSRF
Run Shell Command allows Cross-Site Request Forgery
Published Nov 20, 2023 · Updated Aug 12, 2026 · Also known as GHSA-8jpr-ff92-hpf9
Key Facts
Patch immediately- CVE-2023-48292 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Admin Tools (Xwiki), org.xwiki.contrib:xwiki-application-admintools (maven), application-admintools.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 23% probability of exploitation in the next 30 days.
- Fixed versions are available, including org.xwiki.contrib:xwiki-application-admintools 4.5.1, Admin Tools 4.5.1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
23%
Higher than 97.7% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
40/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2023-48292
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-48292
- advisoryGHSA advisory
- advisoryhttps://jira.xwiki.org/browse/ADMINTOOL-91
- patchhttps://github.com/xwiki-contrib/application-admintools/commit/03815c505c9f37006a0c56495e862dc549a39da8
- patchhttps://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-8jpr-ff92-hpf9
Description
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments.
When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like /xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked in the comment. When an admin views the comment, the file /tmp/attacked will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation.
This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available.
The patch can be applied manually to the affected wiki pages. Alternatively, the document Admin.RunShellCommand can also be deleted if the possibility to run shell commands isn't needed.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Admin ToolsXwiki | See advisory | 4.5.1 |
| org.xwiki.contrib:xwiki-application-admintoolsmaven | >= 4.4 | 4.5.1 |
| application-admintools | >= >= 4.4, < 4.5.1 | n/a |
Patched Releases
org.xwiki.contrib:xwiki-application-admintools
4.5.1
Admin Tools
4.5.1
Timeline
Publicly disclosed
Nov 20, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-352 Cross-Site Request Forgery (CSRF)
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2023-48292
- advisoryGHSA advisory
- advisoryhttps://jira.xwiki.org/browse/ADMINTOOL-91
- patchhttps://github.com/xwiki-contrib/application-admintools/commit/03815c505c9f37006a0c56495e862dc549a39da8
FAQ
Common Questions.
The XWiki Admin Tools Application provides tools to help the administration of XWiki.
Affected: Admin Tools (Xwiki); org.xwiki.contrib:xwiki-application-admintools (maven) versions >= 4.4; application-admintools versions >= >= 4.4, < 4.5.1. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including org.xwiki.contrib:xwiki-application-admintools 4.5.1, Admin Tools 4.5.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2023-48292 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo