CVE-2023-45138

Deeper analysis

Change Request is an XWiki application that lets users submit proposed edits without publishing them directly. Versions 0.11 through 1.9.1 contain a script-injection flaw that permits remote code execution when an attacker supplies a crafted title while creating a new change request. The issue stems from insufficient sanitization of the title field inside ChangeRequest.Code.ChangeRequestSheet, allowing arbitrary script execution with the privileges of the application.

Any unauthenticated or low-privileged user can trigger the vulnerability simply by creating a change request, achieving full remote code execution on the server because the application is explicitly designed to accept input from users without special rights. Successful exploitation yields complete confidentiality, integrity, and availability impact, reflected in the CVSS 10.0 score.

The project’s security advisory and the fix commit at 7565e720117f73102f5a276239eabfe85e15cff4 state that the vulnerability is resolved in Change Request 1.9.2. Administrators who cannot upgrade immediately can apply the same patch manually by editing the ChangeRequest.Code.ChangeRequestSheet document.

The current EPSS of 0.7843 matches the observed peak, indicating sustained exploitation interest since disclosure.