Detections
Analytics

SCA: security update for org.xwiki.contrib:xwiki-application-admintools (GHSA-4f4c-rhjv-4wgv)

high Tenable Cloud Security Plugin ID 410120

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version
 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary
 database queries on the database of the XWiki installation. Among other things, this allows modifying and
 deleting all data of the wiki. This could be both used to damage the wiki and to create an account with
 elevated privileges for the attacker, thus impacting the confidentiality, integrity and availability of
 the whole XWiki instance. A possible attack vector are comments on the wiki, by embedding an image with
 wiki syntax like `[[image:path:/xwiki/bin/view/Admin/QueryOnXWiki?query=DELETE%20FROM%20xwikidoc]]`, all
 documents would be deleted from the database when an admin user views this comment. This has been patched
 in Admin Tools Application 4.5.1 by adding form token checks. Some workarounds are available. The patch
 can also be applied manually to the affected pages. Alternatively, if the query tool is not needed, by
 deleting the document `Admin.SQLToolsGroovy`, all database query tools can be deactivated.
 (CVE-2023-48293)

See Also

https://github.com/advisories/GHSA-4f4c-rhjv-4wgv

Plugin Details

Severity: High

ID: 410120

Version: Revision 1.13

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-48293

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/20/2023

Vulnerability Publication Date: 11/20/2023

Reference Information

CVE: CVE-2023-48293

cwe: CWE-352