XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter
Impact
When login via the OAuth method, the identityOAuth parameters, sent in a GET request is vulnerable to XSS and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation.
The vulnerability is in this part of the code.
Patches
The issue has been fixed in Identity OAuth version 1.6 by https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6 . The fix is in the content of the IdentityOAuth/LoginUIExtension file
Workarounds
There are no known workarounds besides upgrading.
References
Are there any links users can visit to find out more?
- Original report: https://jira.xwiki.org/browse/XWIKI-20719
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.xwiki.identity-oauth:identity-oauth-ui | >= 1.0, < 1.6 | 1.6 |
References
- https://github.com/xwikisas/identity-oauth/security/advisories/GHSA-h2rm-29ch-wfmh
- https://nvd.nist.gov/vuln/detail/CVE-2023-45144
- https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6
- https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6#diff-2ab2e0716443d790d7d798320e4a45151661f4eca5440331f4a227b29c87c188
- https://github.com/xwikisas/identity-oauth
- https://github.com/xwikisas/identity-oauth/blob/master/ui/src/main/resources/IdentityOAuth/LoginUIExtension.vm#L58
- https://jira.xwiki.org/browse/XWIKI-20719
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-79- Platform
- Java / Kotlin (Maven)
- Package
com.xwiki.identity-oauth:identity-oauth-ui- Disclosed
- 17.10.2023
- Updated
- 11.10.2026 11:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-h2rm-29ch-wfmh - CC BY 4.0
Vulnerability history: com.xwiki.identity-oauth:identity-oauth-ui
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.