Detections
Analytics

SCA: security update for org.xwiki.contrib:xwiki-application-admintools (GHSA-8jpr-ff92-hpf9)

high Tenable Self-Hosted Container Security Plugin ID 412740

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version
 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing
 shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin
 into loading the URL with the shell command. A very simple possibility for an attack are comments. When
 the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL
 like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin
 views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is
 also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of
 the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the
 whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin
 tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages.
 Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell
 commands isn't needed. (CVE-2023-48292)

See Also

https://github.com/advisories/GHSA-8jpr-ff92-hpf9

Plugin Details

Severity: High

ID: 412740

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.54

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-48292

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/20/2023

Vulnerability Publication Date: 11/20/2023

Reference Information

CVE: CVE-2023-48292

cwe: CWE-352