GitHub Advisoryadvisory · Maven

GHSA-4j38-rw27-97gx org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages

MEDIUM Published 2026-07-27 Modified 2026-07-27 Official page ↗
Aliases
CVE-2023-37465
Ecosystem
Maven
Packages
org.xwiki.contrib:discussions-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-352
Reviewed
2026-07-27

Affected packages

• Maven org.xwiki.contrib:discussions-server: < 2.0-rc-1 → fixed in 2.0-rc-1

Description

Impact It's possible to forge a request to delete a message. Patches The problem has been patched in version 2.0-rc-1 of Discussion Extension. Workarounds There's no easy workaround except upgrading. References https://jira.xwiki.org/browse/DISCUSSION-22 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki • Email us at security mailing-list

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References