CVE-2023-48240 XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery

🗓️ 20 Nov 2023 17:48:03Reported by GitHub_MType

XWiki Platform SSRF and Cookie Theft CVE-2023-4824

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the XWiki platform, a collaborative web application, lies in its insufficient validation of incoming requests. This allows attackers to gain unauthorized access to cookies files.	14 Feb 202400:00	–	bdu_fstec
CNNVD	XWiki Platform Security Vulnerability	20 Nov 202300:00	–	cnnvd
CVE	CVE-2023-48240	20 Nov 202317:48	–	cve
EUVD	EUVD-2023-2911	3 Oct 202520:07	–	euvd
Github Security Blog	Cookies are sent to external images in rendered diff (and server side request forgery)	20 Nov 202321:00	–	github
NVD	CVE-2023-48240	20 Nov 202318:15	–	nvd
OpenVAS	XWiki 11.10.1 < 14.10.15, 15.x < 15.5.1 SSRF Vulnerability (GHSA-7rfg-6273-f5wp)	27 Dec 202300:00	–	openvas
OSV	CVE-2023-48240 XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery	20 Nov 202317:48	–	osv
OSV	GHSA-7RFG-6273-F5WP Cookies are sent to external images in rendered diff (and server side request forgery)	20 Nov 202321:00	–	osv
Prion	Server side request forgery (ssrf)	20 Nov 202318:15	–	prion

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 11.10.1, < 14.10.15",
        "status": "affected"
      },
      {
        "version": ">= 15.0-rc-1, < 15.5.1",
        "status": "affected"
      },
      {
        "version": ">= 15.6-rc-1, < 15.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
jira	www.jira.xwiki.org/browse/XWIKI-20818
github	www.github.com/xwiki/xwiki-platform/commit/bff0203e739b6e3eb90af5736f04278c73c2a8bb
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-7rfg-6273-f5wp

20 Nov 2023 17:48Current

9.2High risk

Vulners AI Score9.2

CVSS 3.19

EPSS0.0071

xwiki platform server side request forgery cookie theft image embedding