{"id":"CVE-2023-37465","aliases":["GHSA-4j38-rw27-97gx"],"status":"published","title":"org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages","description":"### Impact\nIt's possible to forge a request to delete a message. \n\n### Patches\nThe problem has been patched in version 2.0-rc-1 of Discussion Extension.\n\n### Workarounds\nThere's no easy workaround except upgrading.\n\n### References\nhttps://jira.xwiki.org/browse/DISCUSSION-22\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xwiki.org)\n* Email us at [security mailing-list](mailto:security@xwiki.org)","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2026-07-27T17:04:00Z","modified":"2026-07-27T17:26:45Z","fixes":[{"ecosystem":"Maven","package":"org.xwiki.contrib:discussions-server","fixed_in":["2.0-rc-1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.contrib:discussions-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-rc-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.contrib:discussions-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-rc-1"}]}]}],"references":[{"url":"https://github.com/xwiki-contrib/application-discussions/security/advisories/GHSA-4j38-rw27-97gx","tags":["web"]},{"url":"https://jira.xwiki.org/browse/DISCUSSION-22","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4j38-rw27-97gx"},{"url":"https://github.com/xwiki-contrib/application-discussions","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-4j38-rw27-97gx","title":"org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages","description":"### Impact\nIt's possible to forge a request to delete a message. \n\n### Patches\nThe problem has been patched in version 2.0-rc-1 of Discussion Extension.\n\n### Workarounds\nThere's no easy workaround except upgrading.\n\n### References\nhttps://jira.xwiki.org/browse/DISCUSSION-22\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xwiki.org)\n* Email us at [security mailing-list](mailto:security@xwiki.org)","status":"published","published":"2026-07-27T17:04:00Z","modified":"2026-07-27T17:04:02Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:40:53.707378Z"}],"osv":[{"id":"GHSA-4j38-rw27-97gx","title":"org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages","description":"### Impact\nIt's possible to forge a request to delete a message. \n\n### Patches\nThe problem has been patched in version 2.0-rc-1 of Discussion Extension.\n\n### Workarounds\nThere's no easy workaround except upgrading.\n\n### References\nhttps://jira.xwiki.org/browse/DISCUSSION-22\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xwiki.org)\n* Email us at [security mailing-list](mailto:security@xwiki.org)","status":"published","published":"2026-07-27T17:04:00Z","modified":"2026-07-27T17:26:45.635364Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}