---
title: "Security digest: October 25, 2023"
url: https://erroneo.us/security/2023-10-25/
description: "October 25, 2023 vulnerability digest: 10 critical advisories (npm, Maven). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2023-10-25
date_modified: 2023-10-25
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 25, 2023

10 critical advisories.

## Take stock

- Maven: 8 critical advisories ( org.xwiki.platform:xwiki-platform-office-importer , org.xwiki.platform:xwiki-platform-web-templates , org.xwiki.platform:xwiki-web-standard , org.xwiki.platform:xwiki-platform-web , org.xwiki.rendering:xwiki-rendering-xml , cn.dev33:sa-token-core , com.usthe.sureness:sureness-core ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- npm: 2 critical advisories ( crypto-js , crypto-es ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2023-46233](https://erroneo.us/security/cve/CVE-2023-46233/index.md) crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard — npm crypto-js < 4.2.0 → 4.2.0
- [CVE-2023-37913](https://erroneo.us/security/cve/CVE-2023-37913/index.md) org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter — Maven org.xwiki.platform:xwiki-platform-office-importer >= 3.5-milestone-1, < 14.10.8 → 14.10.8; Maven org.xwiki.platform:xwiki-platform-office-importer >= 15.0-rc-1, < 15.3-rc-1 → 15.3-rc-1
- [CVE-2023-45136](https://erroneo.us/security/cve/CVE-2023-45136/index.md) XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled — Maven org.xwiki.platform:xwiki-platform-web-templates >= 12.0-rc-1, < 14.10.12 → 14.10.12; Maven org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → 15.5-rc-1
- [CVE-2023-46133](https://erroneo.us/security/cve/CVE-2023-46133/index.md) crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard — npm crypto-es < 2.1.0 → 2.1.0
- [CVE-2023-45134](https://erroneo.us/security/cve/CVE-2023-45134/index.md) XWiki Platform XSS vulnerability from account in the create page form via template provider — Maven org.xwiki.platform:xwiki-platform-web-templates < 14.10.12 → 14.10.12; Maven org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → 15.5-rc-1; Maven org.xwiki.platform:xwiki-web-standard >= 2.4-milestone-2, < 3.1-milestone-1 → 3.1-milestone-1
- [CVE-2023-45135](https://erroneo.us/security/cve/CVE-2023-45135/index.md) XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title — Maven org.xwiki.platform:xwiki-platform-web-templates < 14.10.12 → 14.10.12; Maven org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → 15.5-rc-1; Maven org.xwiki.platform:xwiki-platform-web >= 7.2-milestone-2, < 14.10.12 → 14.10.12
- [CVE-2023-45137](https://erroneo.us/security/cve/CVE-2023-45137/index.md) XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages — Maven org.xwiki.platform:xwiki-platform-web-templates < 14.10.12 → 14.10.12; Maven org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → 15.5-rc-1; Maven org.xwiki.platform:xwiki-platform-web >= 3.1-milestone-2, < 13.4-rc-1 → 13.4-rc-1
- [CVE-2023-37908](https://erroneo.us/security/cve/CVE-2023-37908/index.md) org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability — Maven org.xwiki.rendering:xwiki-rendering-xml >= 14.6-rc-1, < 14.10.4 → 14.10.4
- [CVE-2023-44794](https://erroneo.us/security/cve/CVE-2023-44794/index.md) SaToken privilege escalation vulnerability — Maven cn.dev33:sa-token-core < 1.37.0 → 1.37.0
- [CVE-2023-31581](https://erroneo.us/security/cve/CVE-2023-31581/index.md) Sureness uses hardcoded key — Maven com.usthe.sureness:sureness-core < 1.0.8 → 1.0.8

---
Source page: https://erroneo.us/security/2023-10-25/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt