{"id":"CVE-2023-37465","aliases":[],"url":"https://o3.security/vulnerability/CVE-2023-37465","summary":"org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages","details":"### Impact\nIt's possible to forge a request to delete a message. \n\n### Patches\nThe problem has been patched in version 2.0-rc-1 of Discussion Extension.\n\n### Workarounds\nThere's no easy workaround except upgrading.\n\n### References\nhttps://jira.xwiki.org/browse/DISCUSSION-22\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xwiki.org)\n* Email us at [security mailing-list](mailto:security@xwiki.org)","published":"2026-07-27T17:04:00Z","modified":"2026-07-27T17:26:45.635364Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.contrib:discussions-server","fixedVersion":"2.0-rc-1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/xwiki-contrib/application-discussions/security/advisories/GHSA-4j38-rw27-97gx"},{"type":"PACKAGE","url":"https://github.com/xwiki-contrib/application-discussions"},{"type":"WEB","url":"https://jira.xwiki.org/browse/DISCUSSION-22"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-27T17:26:45.635364Z"}}