TI-2023-24159 Aliases CVE-2023-45138 GHSA-f776-w9v2-7vfj

Change Request Application vulnerable to XSS and remote code execution through change request title

HIGH 81CWE-79Published 2023-10-12 · Updated 2024-09-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.71744 99th percentileScored 2026-11-07

Fix Fixed application-changerequest (xwiki-contrib): 1.9.2org.xwiki.contrib.changerequest:application-changerequest-ui (Maven): 1.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
XWiki	application-changerequest	0.11 to before 1.9.2	1.9.2	Patch available	CNA
—	org.xwiki.contrib.changerequest:application-changerequest-ui (Maven)	0.11 to before 1.9.2	1.9.2	Patch available	GHSA-f776-w9v2-7vfj

application-changerequest VendorXWiki Affected 0.11 to before 1.9.2 Fixed in 1.9.2 Patch available CNA
org.xwiki.contrib.changerequest:application-changerequest-ui (Maven) Vendor— Affected 0.11 to before 1.9.2 Fixed in 1.9.2 Patch available GHSA-f776-w9v2-7vfj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:xwiki:change_request::::::::	0.11 to before 1.9.2	Vulnerable	XWiki

cpe:2.3:a:xwiki:change_request:*:*:*:*:*:*:*:* Versions 0.11 to before 1.9.2 Vulnerable ·XWiki

Remediation

Fix · CNA application-changerequest (xwiki-contrib) Fixed in 1.9.2
Fix · GHSA-f776-w9v2-7vfj org.xwiki.contrib.changerequest:application-changerequest-ui (Maven) Fixed in 1.9.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-45138
2026-10-03 Alias added: GHSA-f776-w9v2-7vfj

References

Patch 1

https://github.com/xwiki-contrib/application-changerequest/commit/7565e720117f73102f5a276239eabfe85e15cff4

Advisory 3

Other 1

https://github.com/xwiki-contrib/application-changerequest

TI-2023-26916 Data leak of password hash through xwiki change request CVSS 3.1HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences