{"id":"GHSA-4j38-rw27-97gx","summary":"org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages","details":"### Impact\nIt's possible to forge a request to delete a message. \n\n### Patches\nThe problem has been patched in version 2.0-rc-1 of Discussion Extension.\n\n### Workarounds\nThere's no easy workaround except upgrading.\n\n### References\nhttps://jira.xwiki.org/browse/DISCUSSION-22\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xwiki.org)\n* Email us at [security mailing-list](mailto:security@xwiki.org)","aliases":["CVE-2023-37465"],"modified":"2026-07-29T03:49:55.225463Z","published":"2026-07-27T17:04:00Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-352"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-27T17:04:00Z"},"references":[{"type":"WEB","url":"https://github.com/xwiki-contrib/application-discussions/security/advisories/GHSA-4j38-rw27-97gx"},{"type":"PACKAGE","url":"https://github.com/xwiki-contrib/application-discussions"},{"type":"WEB","url":"https://jira.xwiki.org/browse/DISCUSSION-22"}],"affected":[{"package":{"name":"org.xwiki.contrib:discussions-server","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.contrib/discussions-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-rc-1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-4j38-rw27-97gx/GHSA-4j38-rw27-97gx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}