CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the current user. If a privileged user with programming rights was tricked into executing a GET request to this document with certain parameters (e.g., via an image with a corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code execution and the attacker could gain rights, access private information or impact the availability of the wiki. The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1. There are no known workarounds for this other than upgrading the CKEditor integration to a fixed version.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he     `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing     to execute macros with the rights of the current user. If a privileged user with programming rights was     tricked into executing a GET request to this document with certain parameters (e.g., via an image with a     corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code     execution and the attacker could gain rights, access private information or impact the availability of the     wiki. The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in     the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1. There are no known     workarounds for this other than upgrading the CKEditor integration to a fixed version. (CVE-2023-22457)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he
    `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing
    to execute macros with the rights of the current user. If a privileged user with programming rights was
    tricked into executing a GET request to this document with certain parameters (e.g., via an image with a
    corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code
    execution and the attacker could gain rights, access private information or impact the availability of the
    wiki. The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in
    the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1. There are no known
    workarounds for this other than upgrading the CKEditor integration to a fixed version. (CVE-2023-22457)

ID	Name	Product	Family	Severity
260578	Linux Distros Unpatched Vulnerability : CVE-2023-22457	Nessus	Misc.	high
411533	SCA: security update for org.xwiki.contrib:application-ckeditor-ui (GHSA-6mjp-2rm6-9g85)	Tenable Cloud Security	SCA Checks	high
411533	SCA: security update for org.xwiki.contrib:application-ckeditor-ui (GHSA-6mjp-2rm6-9g85)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2023-22457

high

Tenable Plugins

high

high

high