CVE-2023-37465

Summary

org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages

Severity

medium

CVSS

6.5

CWE

CWE-352

Also known as

GHSA-4j38-rw27-97gx

Published

2026-07-27

Updated

2026-07-27

Advisory details

Impact

It's possible to forge a request to delete a message.

Patches

The problem has been patched in version 2.0-rc-1 of Discussion Extension.

Workarounds

There's no easy workaround except upgrading.

References

https://jira.xwiki.org/browse/DISCUSSION-22

For more information

If you have any questions or comments about this advisory:

• Open an issue in Jira XWiki
• Email us at security mailing-list

References

• https://github.com/advisories/GHSA-4j38-rw27-97gx
• https://github.com/xwiki-contrib/application-discussions/security/advisories/GHSA-4j38-rw27-97gx
• https://jira.xwiki.org/browse/DISCUSSION-22

Related advisories

• CVE-2026-52777 — critical · Packagist/yeswiki/yeswiki
• CVE-2026-53649 — critical · Go/github.com/BishopFox/joro
• CVE-2026-84312 — high · Go/Nginx-UI
• CVE-2026-107809 — high · Go/github.com/0xJacky/Nginx-UI
• CVE-2026-107295 — high · PyPI/pydantic-ai
• CVE-2026-61687 — high · Go/hatchet
• CVE-2026-61593 — high · PyPI/djust
• CVE-2026-59148 — high · npm/@mockoon/commons-server

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity