CVE-2023-29513

    Dashboard / Vulnerabilities / CVE-2023-29513

    CVE-2023-29513

    Published: 18 Apr 2023Last Modified: 12 Aug 2026

    Summary: Users can be created even when registration is disabled without validation via the template macro in xwiki-platform

    Details: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context. This vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1. There is no known workaround other than upgrading.

    References: https://jira.xwiki.org/browse/XWIKI-19852, https://jira.xwiki.org/browse/XWIKI-20400, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29513.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp36-mjw5-fmgx, https://nvd.nist.gov/vuln/detail/CVE-2023-29513

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -92a80f0a6344f8c7efb8373f8604d007e775625b

    Affected versions

    xwiki-commons-14.10

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-29513 | CVE-DB