CVE-2023-29506

XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.

Published: Apr 16, 2023
Updated: May 9, 2024
CVE: CVE-2023-29506
GHSA: GHSA-jjm5-5v9v-7hx2
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
org.xwiki.platform / xwiki-platform-security-authentication-default	13.10.8	13.10.11
org.xwiki.platform / xwiki-platform-security-authentication-default	14.4.3	14.4.7
org.xwiki.platform / xwiki-platform-security-authentication-default	14.6	14.10
xwiki / xwiki	14.10-rc1	14.10-rc1.x
xwiki / xwiki	13.10.8	13.10.11
xwiki / xwiki	14.6	14.6.x
xwiki / xwiki	14.4.3	14.4.7

https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jjm5-5v9v-7hx2
https://jira.xwiki.org/browse/XWIKI-20335

Vulnerability Database

CVE-2023-29506

Deep Security Visibility Without the Complexity