PT-2023-23581 · Unknown · Xwiki Platform

Paulos Mesfin · Published 2023-05-15 · Updated 2023-05-24 · CVE-2023-32068

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.10.4

Description The XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4, it is possible to exploit well-known parameters in XWiki URLs to perform redirection to an untrusted site. This issue was partially fixed in the past for XWiki 12.10.7 and 13.3RC1, but there was still the possibility to force specific URLs to skip some checks. For example, using URLs like http:example.com in the parameter would allow the redirect. The issue has now been patched against all patterns that are known for performing redirects.

Recommendations To resolve the issue, users are advised to upgrade to XWiki 14.10.4 or 15.0, as these versions have the patch for the vulnerability. There are no known workarounds for this issue other than upgrading.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2023-32068

GHSA-6GVJ-8VC5-8V3J

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32068.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6gvj-8vc5-8v3j · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e · Patch
• https://jira.xwiki.org/browse/XWIKI-20549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32068 · Security Note
• https://jira.xwiki.org/browse/XWIKI-20096 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32068 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6gvj-8vc5-8v3j · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/64169 · Telegram Post
• https://github.com/advisories/GHSA-jp55-vvmf-63mv · Note