CVE-2023-29208

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked. The problem has been patched in XWiki 14.10 by checking the rights of current user: only admin and deleter of the document are allowed to view it.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-668

Affected software

VendorProductVersions
xwikixwiki-platform>= 1.2-milestone-1, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10

References

Timeline

Published
Apr 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-292098.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible docCVE-2023-29218.8The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to CVE-2023-292108.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible docCVE-2023-292118.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` cCVE-2023-292128.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary GrooCVE-2023-292138.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.CVE-2023-292148.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary GrooCVE-2023-292159.8In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JCVE-2023-292169.8In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parametCVE-2023-292187.5The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arrangCVE-2023-29226.1A vulnerability classified as problematic has been found in SourceCodester Comment System 1.0. Affected is an unknown function of the file iCVE-2023-29239.8A vulnerability classified as critical was found in Tenda AC6 US_AC6V1.0BR_V15.03.05.19. Affected by this vulnerability is the function from