PT-2023-22201 · Xwiki · Xwiki Commons

Fabian Hafner · Published 2023-04-12 · Updated 2023-04-26 · CVE-2023-29204

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Commons versions prior to 13.10.10 XWiki Commons versions prior to 14.4.4 XWiki Commons versions prior to 14.8RC1

Description It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:) or a URL such as http:/mydomain.com.

Recommendations For versions prior to 13.10.10, update to version 13.10.10 or later. For versions prior to 14.4.4, update to version 14.4.4 or later. For versions prior to 14.8RC1, update to version 14.8RC1 or later. As a temporary workaround, consider providing a patched jar of xwiki-platform-oldcore containing the necessary changes.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2023-29204

GHSA-XWPH-X6XJ-WGGV

Affected Products

Xwiki Commons

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29204.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19994 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-10309 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-29204 · Security Note
• https://osv.dev/vulnerability/GHSA-xwph-x6xj-wggv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29204 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv · Note
• https://t.me/cibsecurity/62230 · Telegram Post