GitHub Advisoryadvisory · Maven

GHSA-jjm5-5v9v-7hx2 org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticate endpoints

MEDIUM Published 2023-04-12 Modified 2023-04-26 Official page ↗
Aliases
CVE-2023-29506
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-security-authentication-default
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-04-12

Affected packages

• Maven org.xwiki.platform:xwiki-platform-security-authentication-default: >= 13.10.8, < 13.10.11 → fixed in 13.10.11 • Maven org.xwiki.platform:xwiki-platform-security-authentication-default: >= 14.4.3, < 14.4.7 → fixed in 14.4.7 • Maven org.xwiki.platform:xwiki-platform-security-authentication-default: >= 14.6, < 14.10 → fixed in 14.10

Description

Impact It was possible to inject some code using the URL of authenticate endpoints, e.g.: ``` https://hostname/xwiki/authenticate/wiki/xwiki%22onload=%22alert(origin)%22/resetpassword ``` This vulnerability was present in recent versions of XWiki: • 13.10.8+ • 14.4.3+ • 14.6+ Patches This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10. Workarounds There is no easy workaround except to upgrade. References • https://jira.xwiki.org/browse/XWIKI-20335 • https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380 For more information If you have any questions or comments about this advisory: • Open an issue in Jira • Email us at security mailing-list

Related

Alias · CVE (1)

  • CVE-2023-29506 XWiki Commons are technical libraries common to several other top level XWiki projects. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References