PT-2023-22201 · Xwiki · Xwiki Commons

Fabian Hafner · Publicado 2023-04-12 · Atualizado 2023-04-26 · CVE-2023-29204

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Commons versions prior to 13.10.10 XWiki Commons versions prior to 14.4.4 XWiki Commons versions prior to 14.8RC1

Description It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:) or a URL such as http:/mydomain.com.

Recommendations For versions prior to 13.10.10, update to version 13.10.10 or later. For versions prior to 14.4.4, update to version 14.4.4 or later. For versions prior to 14.8RC1, update to version 14.8RC1 or later. As a temporary workaround, consider providing a patched jar of xwiki-platform-oldcore containing the necessary changes.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2023-29204

GHSA-XWPH-X6XJ-WGGV

Produtos afetados

Xwiki Commons

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29204.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19994 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-10309 · Exploit
• https://github.com/xwiki/xwiki-platform · Nota
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv · Nota
• https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf · Correção
• https://t.me/cibsecurity/62230 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-29204 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xwph-x6xj-wggv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-29204 · Aviso do Fabricante