CVE-2023-29204
URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore
XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:). It was also possible to bypass it when using URL such as http:/mydomain.com. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore
XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:). It was also possible to bypass it when using URL such as http:/mydomain.com. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
- Record
CVE-2023-29204- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2023-1434
XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:). It was also possible to bypass it when using URL such as http:/mydomain.com. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
- Record
EUVD-2023-1434- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xwph-x6xj-wggv
org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability
Impact
It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:). It was also possible to bypass it when using URL such as http:/mydomain.com.
Patches
The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
Workarounds
The only way to workaround the bug is by providing a patched jar of xwiki-platform-oldcore containing the following changes: https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf.
References
- Jira ticket of the reported vulnerability: https://jira.xwiki.org/browse/XWIKI-19994
- Jira ticket of the original mechanism put in place to prevent open redirect: https://jira.xwiki.org/browse/XWIKI-10309
- Original advisory about open redirect: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira
- Email us at Security ML
- Record
GHSA-xwph-x6xj-wggv- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:). It was also possible to bypass it when using URL such as http:/mydomain.com. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
- Record
CVE-2023-29204- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore
XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:). It was also possible to bypass it when using URL such as http:/mydomain.com. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
- Record
CVE-2023-29204- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-xwph-x6xj-wggv
org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability
Impact
It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as //mydomain.com (i.e. omitting the http:). It was also possible to bypass it when using URL such as http:/mydomain.com.
Patches
The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
Workarounds
The only way to workaround the bug is by providing a patched jar of xwiki-platform-oldcore containing the following changes: https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf.
References
- Jira ticket of the reported vulnerability: https://jira.xwiki.org/browse/XWIKI-19994
- Jira ticket of the original mechanism put in place to prevent open redirect: https://jira.xwiki.org/browse/XWIKI-10309
- Original advisory about open redirect: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira
- Email us at Security ML
- Record
GHSA-xwph-x6xj-wggv- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xwiki.platform:xwiki-platform-oldcoreMaven |
6.0-rc-1 up to 13.10.10 | 13.10.10 |
org.xwiki.platform:xwiki-platform-oldcoreMaven |
14.0-rc-1 up to 14.4.4 | 14.4.4 |
org.xwiki.platform:xwiki-platform-oldcoreMaven |
14.5 up to 14.8-rc-1 | 14.8-rc-1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | XWiki - Open Redirect |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-29204 is a medium vulnerability (CVSS 4.7) in Xwiki, published April 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile. Fixed in org.xwiki.platform:xwiki-platform-oldcore 13.10.10.
References
github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv
jira.xwiki.org/browse/XWIKI-10309
nvd.nist.gov/vuln/detail/CVE-2023-29204