{"id":"CVE-2023-37465","aliases":["GHSA-4j38-rw27-97gx"],"title":"org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages","summary":"org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages","severity":"medium","cvss":6.5,"cwe":["CWE-352"],"vendor":"xwiki","product":"org.xwiki.contrib:discussions-server","ecosystem":"maven","affected":["org.xwiki.contrib:discussions-server < 2.0-rc-1"],"patched":["org.xwiki.contrib:discussions-server 2.0-rc-1"],"published":"2026-07-27","updated":"2026-07-27","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4j38-rw27-97gx","references":[{"url":"https://github.com/xwiki-contrib/application-discussions/security/advisories/GHSA-4j38-rw27-97gx"},{"url":"https://jira.xwiki.org/browse/DISCUSSION-22"},{"url":"https://github.com/advisories/GHSA-4j38-rw27-97gx"}],"tags":["ghsa","maven"],"ingestedAt":"2026-07-27T17:21:55.832Z","slug":"CVE-2023-37465","body":"## Overview\n\n### Impact\nIt's possible to forge a request to delete a message. \n\n### Patches\nThe problem has been patched in version 2.0-rc-1 of Discussion Extension.\n\n### Workarounds\nThere's no easy workaround except upgrading.\n\n### References\nhttps://jira.xwiki.org/browse/DISCUSSION-22\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xwiki.org)\n* Email us at [security mailing-list](mailto:security@xwiki.org)\n\n## Affected packages\n\n- `org.xwiki.contrib:discussions-server < 2.0-rc-1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.xwiki.contrib:discussions-server 2.0-rc-1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}