CVE-2023-29204

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-292055.4XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a pro CVE-2023-292065.4XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xob CVE-2023-292079.0XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing colum CVE-2023-292087.5XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into accoun CVE-2023-292098.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible doc CVE-2023-29218.8The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to CVE-2023-292108.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible doc CVE-2023-292118.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` c CVE-2023-292128.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groo CVE-2023-292138.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.CVE-2023-292148.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groo CVE-2023-292159.8In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in J