CVE-2023-29204

    Dashboard / Vulnerabilities / CVE-2023-29204

    CVE-2023-29204

    Published: 15 Apr 2023Last Modified: 12 Aug 2026

    Summary: URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore

    Details: XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

    References: https://jira.xwiki.org/browse/XWIKI-10309, https://jira.xwiki.org/browse/XWIKI-19994, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29204.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv, https://nvd.nist.gov/vuln/detail/CVE-2023-29204, https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a54424640068c0da4820bb6892cd61be80ae19a0
    Fixed -bc18e50bcf9ea40d1e25ff8d065b3178c8247f16

    Affected versions

    xwiki-commons-13.10.9
    xwiki-commons-13.10.8
    xwiki-commons-13.10.7
    xwiki-commons-13.10.6
    xwiki-commons-13.10.5
    xwiki-commons-13.10.4
    xwiki-commons-13.10.3
    xwiki-commons-13.10.2
    xwiki-commons-13.10.1
    xwiki-commons-13.10

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-29204 | CVE-DB