Detections
Analytics

SCA: security update for org.xwiki.contrib.changerequest:application-changerequest-ui (GHSA-f776-w9v2-7vfj)

critical Tenable Cloud Security Plugin ID 414349

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Change Request is an pplication allowing users to request changes on a wiki without publishing the changes
 directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any
 specific right to perform script injection and remote code execution just by inserting an appropriate
 title when creating a new Change Request. This vulnerability is particularly critical as Change Request
 aims at being created by user without any particular rights. The vulnerability has been fixed in Change
 Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document
 `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit.
 (CVE-2023-45138)

See Also

https://github.com/advisories/GHSA-f776-w9v2-7vfj

Plugin Details

Severity: Critical

ID: 414349

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.66

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-45138

CVSS v3

Risk Factor: Critical

Base Score: 9.6

Temporal Score: 8.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/17/2023

Vulnerability Publication Date: 10/12/2023

Reference Information

CVE: CVE-2023-45138

cwe: CWE-79