---
title: "CVE-2023-48292: Run Shell Command allows Cross-Site Request Forgery"
url: https://erroneo.us/security/cve/CVE-2023-48292/
description: "CVE-2023-48292 (org.xwiki.contrib:xwiki-application-admintools (Maven)): The XWiki Admin Tools Application provides tools to help the administration of…"
type: vulnerability-record
section: "Security Digest"
date_published: 2023-11-20
date_modified: 2024-08-02
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2023-48292"
kev: false
cvss: 9.7
epss: 0.22938
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2023-48292: Run Shell Command allows Cross-Site Request Forgery

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 22.9% , percentile 98: FIRST’s model estimates a 22.9% chance of exploitation activity in the next 30 days, higher than 98% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
- Only applies if your dependency tree includes org.xwiki.contrib:xwiki-application-admintools (Maven) >= 4.4, < 4.5.1, fixed in 4.5.1 . Check your lockfile, including transitive dependencies.

## What it is

The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like /xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked in the comment. When an admin views the comment, the file /tmp/attacked will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document Admin.RunShellCommand can also be deleted if the possibility to run shell commands isn't needed.

## Affected packages

- Maven `org.xwiki.contrib:xwiki-application-admintools` >= 4.4, < 4.5.1 → fixed: 4.5.1

## Affected products (CVE record)

- xwiki-contrib application-admintools: >= 4.4, < 4.5.1

## Severity

- GitHub_M CVSS 3.1: 9.7 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- FIRST EPSS (model of 2026-10-21): 22.94% probability of exploitation activity in the next 30 days; percentile 98.

## Sources

- [GitHub Advisory GHSA-8jpr-ff92-hpf9](https://github.com/advisories/GHSA-8jpr-ff92-hpf9)
- [CVE.org record CVE-2023-48292](https://www.cve.org/CVERecord?id=CVE-2023-48292)
- [NVD entry CVE-2023-48292](https://nvd.nist.gov/vuln/detail/CVE-2023-48292)
- [github.com](https://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-8jpr-ff92-hpf9)
- [github.com](https://github.com/xwiki-contrib/application-admintools/commit/03815c505c9f37006a0c56495e862dc549a39da8)
- [jira.xwiki.org](https://jira.xwiki.org/browse/ADMINTOOL-91)

---
Source page: https://erroneo.us/security/cve/CVE-2023-48292/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt