CVE-2023-22457

CKEditor Integration UI adds support for editing wiki pages using CKEditor.
Prior to versions 1.64.3,t he CKEditor.HTMLConverter document lacked a
protection against Cross-Site Request Forgery (CSRF), allowing to execute
macros with the rights of the current user. If a privileged user with
programming rights was tricked into executing a GET request to this
document with certain parameters (e.g., via an image with a corresponding
URL embedded in a comment or via a redirect), this would allow arbitrary
remote code execution and the attacker could gain rights, access private
information or impact the availability of the wiki. The issue has been
patched in the CKEditor Integration version 1.64.3. This has also been
patched in the version of the CKEditor integration that is bundled starting
with XWiki 14.6 RC1. There are no known workarounds for this other than
upgrading the CKEditor integration to a fixed version.

Notes