{"id":"CVE-2023-29506","aliases":["EUVD-2023-1341","GHSA-jjm5-5v9v-7hx2"],"status":"published","title":"org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01721,"percentile":0.77674,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-04-12T20:36:19Z","modified":"2026-10-28T10:35:45Z","exploits":[{"source":"nuclei","id":"CVE-2023-29506","title":"XWiki \u003e= 13.10.8 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29506.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-security-authentication-default","fixed_in":["13.10.11","14.4.7","14.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-security-authentication-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.10.8"},{"fixed":"13.10.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-security-authentication-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.4.3"},{"fixed":"14.4.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-security-authentication-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.6"},{"fixed":"14.10"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-security-authentication-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.10.8"},{"fixed":"13.10.11"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-security-authentication-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.4.3"},{"fixed":"14.4.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-security-authentication-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.6"},{"fixed":"14.10"}]}]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jjm5-5v9v-7hx2","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20335","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29506","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jjm5-5v9v-7hx2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29506.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-29506","title":"org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.","status":"published","published":"2023-04-16T06:49:51.376Z","modified":"2025-02-06T17:02:00.453Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:28.643185Z"}],"euvd":[{"id":"EUVD-2023-1341","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.","status":"published","published":"2023-04-16T06:49:51Z","modified":"2025-02-06T17:02:00Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:02.906364Z"}],"ghsa":[{"id":"GHSA-jjm5-5v9v-7hx2","title":"org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticate endpoints","description":"### Impact\n\nIt was possible to inject some code using the URL of authenticate endpoints, e.g.:\n\n```\nhttps://hostname/xwiki/authenticate/wiki/xwiki%22onload=%22alert(origin)%22/resetpassword\n```\n\nThis vulnerability was present in recent versions of XWiki:\n  - 13.10.8+\n  - 14.4.3+\n  - 14.6+\n\n### Patches\n\nThis problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.\n\n### Workarounds\nThere is no easy workaround except to upgrade.\n\n### References\n\n  - https://jira.xwiki.org/browse/XWIKI-20335\n  - https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira](https://jira.xwiki.org)\n* Email us at [security mailing-list](mailto:security@xwiki.org)\n","status":"published","published":"2023-04-12T20:36:19Z","modified":"2023-04-26T20:33:33Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:51.39133Z"}],"nvd":[{"id":"CVE-2023-29506","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.","status":"published","published":"2023-04-16T07:15:53.123Z","modified":"2026-06-17T05:50:14.98Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:55.652109Z"}],"osv":[{"id":"CVE-2023-29506","title":"org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.","status":"published","published":"2023-04-16T06:49:51.376Z","modified":"2026-10-28T10:35:45.84364472Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-jjm5-5v9v-7hx2","title":"org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticate endpoints","description":"### Impact\n\nIt was possible to inject some code using the URL of authenticate endpoints, e.g.:\n\n```\nhttps://hostname/xwiki/authenticate/wiki/xwiki%22onload=%22alert(origin)%22/resetpassword\n```\n\nThis vulnerability was present in recent versions of XWiki:\n  - 13.10.8+\n  - 14.4.3+\n  - 14.6+\n\n### Patches\n\nThis problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.\n\n### Workarounds\nThere is no easy workaround except to upgrade.\n\n### References\n\n  - https://jira.xwiki.org/browse/XWIKI-20335\n  - https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira](https://jira.xwiki.org)\n* Email us at [security mailing-list](mailto:security@xwiki.org)\n","status":"published","published":"2023-04-12T20:36:19Z","modified":"2023-11-08T04:12:19.286671Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:50.687609Z"}]}}