CVE-2023-29506 json
org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints
published 2023-04-12 3 y ago modified 2026-06-17 4 mo ago also GHSA-jjm5-5v9v-7hx2 , EUVD-2023-1341
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-security-authentication-default 13.10.11, 14.4.7, 14.10
- xwiki xwiki 13.10.11, 14.4.7
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
1.72% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template XWiki >= 13.10.8 - Cross-Site Scripting nuclei detection template
- github.com https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jjm5-5v9v-7hx2 referenced PoC, tagged "exploit" by a source, unverified
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-20335 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-security-authentication-default | >=13.10.8, <13.10.11 >=14.4.3, <14.4.7 >=14.6, <14.10 |
13.10.11 14.4.7 14.10 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380
web, patch
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-jjm5-5v9v-7hx2
web, exploit, patch, vendor-advisory
-
jira.xwiki.org
/browse/XWIKI-20335
web, exploit, issue-tracking
-
nvd.nist.gov
/vuln/detail/CVE-2023-29506
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2023-29506
- GitHub Advisory GHSA-jjm5-5v9v-7hx2
- NVD CVE-2023-29506
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.