CVE-2023-49280: 
Java vulnerability analysis and mitigation

XWiki Change Request is an XWiki application that allows users to request changes on a wiki without directly publishing them. A vulnerability (CVE-2023-49280) was discovered that affects all versions of Change Request prior to version 1.10. The vulnerability allows attackers to obtain password hashes of users by performing edits on user profiles and downloading the resulting XML file. The issue was discovered in August 2023 and patched in version 1.10 released in December 2023 (GitHub Advisory).

The vulnerability stems from the application's default behavior of allowing edits to any page and exporting changes in an XML file that can be downloaded by users. When a user edits a page containing password fields (such as user profiles) through the Change Request feature, the password hashes are included in the exported XML file. The vulnerability has been assigned a CVSS v3.1 base score of 7.7 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and high impact on confidentiality (GitHub Advisory).

The vulnerability allows attackers to obtain password hashes of users by editing user profiles or any document containing password fields that they have view access to. These hashes can then be used for offline password cracking attempts. The impact depends on the rights configured in the wiki, as it requires the attacker to have both Change Request rights (enabled by default) and view rights on the target page (GitHub Advisory).

The vulnerability has been patched in Change Request version 1.10 by denying users the right to edit pages containing password fields through change requests. Administrators should upgrade immediately to this version. As a workaround, administrators can manually deny the Change Request right on specific spaces, such as the XWiki space which includes user profiles by default. It's important to note that existing change requests for affected pages are not automatically removed by the patch and need to be manually addressed by administrators (GitHub Advisory).