Vulnerability · Published Apr 16, 2023 · Assigned by GitHub_M
CVE-2023-29506org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints
Medium 5.4
In plain English
A medium-severity cross-site scripting in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.7%top 22.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-security-authentication-default | 13.10.11 | GHSA-jjm5-5v9v-7hx2 |
| Maven | org.xwiki.platform:xwiki-platform-security-authentication-default | 14.4.7 | GHSA-jjm5-5v9v-7hx2 |
| Maven | org.xwiki.platform:xwiki-platform-security-authentication-default | 14.10 | GHSA-jjm5-5v9v-7hx2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 13.10.8, < 13.10.11>= 14.4.3, < 14.4.7>= 14.6, < 14.10 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jjm5-5v9v-7hx2 x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-20335 x_refsource_MISC