Digest · Wednesday

Security digest: October 25, 2023

10 critical advisories.

Take stock

Maven: 8 critical advisories (org.xwiki.platform:xwiki-platform-office-importer, org.xwiki.platform:xwiki-platform-web-templates, org.xwiki.platform:xwiki-web-standard, org.xwiki.platform:xwiki-platform-web, org.xwiki.rendering:xwiki-rendering-xml, cn.dev33:sa-token-core, com.usthe.sureness:sureness-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
npm: 2 critical advisories (crypto-js, crypto-es). Check with npm audit (or: npm ls <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 10

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 8

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter CVE-2023-37913 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-office-importer >= 3.5-milestone-1, < 14.10.8 → fixed in 14.10.8; org.xwiki.platform:xwiki-platform-office-importer >= 15.0-rc-1, < 15.3-rc-1 → fixed in 15.3-rc-1
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled CVE-2023-45136 CVSS 9.6 Critical
org.xwiki.platform:xwiki-platform-web-templates >= 12.0-rc-1, < 14.10.12 → fixed in 14.10.12; org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → fixed in 15.5-rc-1
XWiki Platform XSS vulnerability from account in the create page form via template provider CVE-2023-45134 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-web-templates < 14.10.12 → fixed in 14.10.12; org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → fixed in 15.5-rc-1; org.xwiki.platform:xwiki-web-standard >= 2.4-milestone-2, < 3.1-milestone-1 → fixed in 3.1-milestone-1; +1 more packages
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title CVE-2023-45135 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-web-templates < 14.10.12 → fixed in 14.10.12; org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → fixed in 15.5-rc-1; org.xwiki.platform:xwiki-platform-web >= 7.2-milestone-2, < 14.10.12 → fixed in 14.10.12
XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages CVE-2023-45137 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-web-templates < 14.10.12 → fixed in 14.10.12; org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → fixed in 15.5-rc-1; org.xwiki.platform:xwiki-platform-web >= 3.1-milestone-2, < 13.4-rc-1 → fixed in 13.4-rc-1
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability CVE-2023-37908 CVSS 9.6 Critical
org.xwiki.rendering:xwiki-rendering-xml >= 14.6-rc-1, < 14.10.4 → fixed in 14.10.4
SaToken privilege escalation vulnerability CVE-2023-44794 CVSS 9.3 Critical
cn.dev33:sa-token-core < 1.37.0 → fixed in 1.37.0
Sureness uses hardcoded key CVE-2023-31581 CVSS 9.8 Critical
com.usthe.sureness:sureness-core < 1.0.8 → fixed in 1.0.8

npm 2

Check: npm audit (or: npm ls <package>)

crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard CVE-2023-46233 CVSS 9.1 Critical
crypto-js < 4.2.0 → fixed in 4.2.0
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard CVE-2023-46133 CVSS 9.1 Critical
crypto-es < 2.1.0 → fixed in 2.1.0