CVE-2023-29211

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-95 CWE-94

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 5.3-milestone-2, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10

References

https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4Exploit, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20297Exploit, Issue Tracking
https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4Exploit, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20297Exploit, Issue Tracking

Timeline

Published: Apr 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-292128.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groo CVE-2023-292138.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.CVE-2023-292148.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groo CVE-2023-292159.8In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in J CVE-2023-292169.8In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious paramet CVE-2023-292187.5The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arrang CVE-2023-29226.1A vulnerability classified as problematic has been found in SourceCodester Comment System 1.0. Affected is an unknown function of the file i CVE-2023-29239.8A vulnerability classified as critical was found in Tenda AC6 US_AC6V1.0BR_V15.03.05.19. Affected by this vulnerability is the function from CVE-2023-292349.8A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2 CVE-2023-292358.8Cross-Site Request Forgery (CSRF) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions.CVE-2023-292366.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions.CVE-2023-292376.3Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Securi