CVE-2023-29517

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user running the servlet engine (e.g. tomcat) running XWiki. The same vulnerability also allowed to perform internal requests to resources from the hosting server. The problem has been patched in XWiki 13.10.11, 14.10.1, 14.4.8, 15.0-rc-1. Users are advised to upgrade. It might be possible to workaround this vulnerability by running XWiki in a sandbox with a user with very low privileges on the machine.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-295188.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execuCVE-2023-295198.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remotCVE-2023-29526.5XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted captureCVE-2023-295206.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to break many translaCVE-2023-295218.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execuCVE-2023-295228.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execuCVE-2023-295238.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own useCVE-2023-295248.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute anything wCVE-2023-295258.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subjCVE-2023-295268.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-295278.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user withoutCVE-2023-295289.0XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki,
CVE-2023-29517: High severity, CVSS 7.5 | Vulnix