CVE-2023-29506

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-29506

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29506.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-29506

Aliases

GHSA-jjm5-5v9v-7hx2

Published

2023-04-16T06:49:51.376Z

Modified

2025-11-30T14:16:17.832465Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints

Details

XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type: GIT
Repo: https://github.com/xwiki/xwiki-commons
Events: Introduced

f1061cdd99a531c74466c225011a1d25d203a14b

Fixed

8d72461ba6976af6005e2df511bdeeeb17ef2d74

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type: GIT
Repo: https://github.com/xwiki/xwiki-platform
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

1943ea26c967ef868fb5f67c487d98d97cba0380

Affected versions

xwiki-application-calendar-1.*

xwiki-application-calendar-1.0

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2

xwiki-platform-7.4-milestone-1

xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1

xwiki-platform-8.0-milestone-2

xwiki-platform-8.1-milestone-1

xwiki-platform-8.1-milestone-2

xwiki-platform-8.2-milestone-1

xwiki-platform-8.2-milestone-2

xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

xwiki-plugin-tag-1.*

xwiki-plugin-tag-1.1

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandler.java"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "105201964671355131846929292978469665696",
                "9141370093161360247023852902825816501",
                "276698484318752629600384579683305212286",
                "74727066728448478833029807160696679991",
                "4531002543764502459188552604889152265",
                "59348115275863142941578963662605444705",
                "284106238438216861385481074090033998516",
                "202125792419474882259852907899001988742",
                "31036814902387404794806644621681912011",
                "87896390684527757627012943064927617839"
            ]
        },
        "id": "CVE-2023-29506-0a0d5b90",
        "signature_type": "Line",
        "source": "https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandlerTest.java",
            "function": "handleForgotUsername"
        },
        "digest": {
            "length": 764.0,
            "function_hash": "259250603292762372071435436403739177942"
        },
        "id": "CVE-2023-29506-1a7799d8",
        "signature_type": "Function",
        "source": "https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandlerTest.java"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333837371687335403038655646632368271587",
                "322471603235072033359025686691845572083",
                "285657594438487939294528518832836066624",
                "252467953113046119743895566555696432483",
                "405503113753934760506935605700825918",
                "183023154997310394447362879453864155998",
                "122742562168827293088327038393299611731",
                "234304701566168278544084230158346681592",
                "14343461921798507923617311646528531443",
                "149446792529219615153142501685021787645",
                "233933077768182912918242962850497287926",
                "155681099482721782751564023498288494088",
                "24347539411103939997957456250745781424",
                "285563796423245892745779288016647610018",
                "297658205955392371763498974488565107232",
                "263572100187667573573342955066526503509",
                "58975148321999911325292113347959031535",
                "87221691737235509398048846725519556512",
                "285206882378718838820173041136660173387",
                "49887068424729508190692205618556526676",
                "198808292575323673255983861159864594831",
                "299609130126879767028664506979020047407",
                "266923008138003996036736012538604470664",
                "52019094538943582983063545863143125330",
                "12601766032825209492719264670039146515",
                "106008977246898217958188695954446741706",
                "191369365569964437196436253404008526805",
                "102784022670232590119883481164126181165",
                "48096146621246234578613132547083120196",
                "141124716784628640804632709362652374779",
                "267213921207830434204776071410110400909",
                "109754639994143263104908456491204350258",
                "233825908038872426353696278308383365962",
                "12601766032825209492719264670039146515",
                "322399470899500000877664270905528824364",
                "229147799604202575167218719069119907732",
                "3922704288715925856310335444398355760"
            ]
        },
        "id": "CVE-2023-29506-866c6848",
        "signature_type": "Line",
        "source": "https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandler.java",
            "function": "handle"
        },
        "digest": {
            "length": 374.0,
            "function_hash": "109854637687187732252365675960948256594"
        },
        "id": "CVE-2023-29506-99a9d0c3",
        "signature_type": "Function",
        "source": "https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandlerTest.java",
            "function": "handleResetPassword"
        },
        "digest": {
            "length": 756.0,
            "function_hash": "128749741452279076889621858980274722778"
        },
        "id": "CVE-2023-29506-e2ff609d",
        "signature_type": "Function",
        "source": "https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380",
        "signature_version": "v1"
    }
]