CVE-2023-29203

    Dashboard / Vulnerabilities / CVE-2023-29203

    CVE-2023-29203

    Published: 15 Apr 2023Last Modified: 12 Aug 2026

    Summary: Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm

    Details: XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with `uorgsuggest.vm`. This issue only concerns hidden users from main wiki. Note that the disclosed information are the username and the first and last name of users, no other information is leaked. The problem has been patched on XWiki 13.10.8, 14.4.3 and 14.7RC1.

    References: https://jira.xwiki.org/browse/XWIKI-20007, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29203.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vvp7-r422-rx83, https://nvd.nist.gov/vuln/detail/CVE-2023-29203, https://github.com/xwiki/xwiki-platform/pull/1883

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fdc1d93ce4d83acb75c4a768f76c554cb9772ba5
    Fixed -f1061cdd99a531c74466c225011a1d25d203a14b

    Affected versions

    xwiki-commons-14.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-29203 | CVE-DB