What’s Vulnerable › Vulnerabilities

CVE-2023-29204: URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-15 · updated 2026-06-17
• Weakness: CWE-601

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

Affected products

• xwiki-platform: from 6.0 before 13.10.10; from 14.4.0 before 14.4.4; from 14.5 through 14.7; 6.0-rc1 — fixed in 13.10.10, 14.4.4

How to fix

Upgrade to a fixed version: xwiki-platform 13.10.10, 14.4.4. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv
• https://jira.xwiki.org/browse/XWIKI-10309
• https://jira.xwiki.org/browse/XWIKI-19994
• https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv
• https://jira.xwiki.org/browse/XWIKI-10309
• https://jira.xwiki.org/browse/XWIKI-19994

Get alerted when CVE-2023-29204 or the next vulnerability affects your stack