What’s Vulnerable › Vulnerabilities

CVE-2023-29513: Users can be created even when registration is disabled without validation via the template macro in xwiki-platform

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-19 · updated 2026-06-17
• Weakness: CWE-284

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context. This vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1. There is no known workaround other than upgrading.

Affected products

• xwiki-platform: before 14.10.1 — fixed in 14.10.1

How to fix

Upgrade to a fixed version: xwiki-platform 14.10.1. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp36-mjw5-fmgx
• https://jira.xwiki.org/browse/XWIKI-19852
• https://jira.xwiki.org/browse/XWIKI-20400
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp36-mjw5-fmgx
• https://jira.xwiki.org/browse/XWIKI-19852
• https://jira.xwiki.org/browse/XWIKI-20400

Get alerted when CVE-2023-29513 or the next vulnerability affects your stack