{"id":"CVE-2023-29506","summary":"org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints","details":"XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.","aliases":["GHSA-jjm5-5v9v-7hx2"],"modified":"2026-08-12T13:32:34.758735Z","published":"2023-04-16T06:49:51.376Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29506.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20335"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29506.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jjm5-5v9v-7hx2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29506"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"f1061cdd99a531c74466c225011a1d25d203a14b"},{"fixed":"8d72461ba6976af6005e2df511bdeeeb17ef2d74"},{"introduced":"c919088389a89000b2e687f6ae845150c168b967"},{"fixed":"5d5ba1ade22d91d0fd6bf3dd20bb96fa64264a97"},{"introduced":"1a52e374158eb78ff4b32aaa2b8e8c41e586877d"},{"last_affected":"1a52e374158eb78ff4b32aaa2b8e8c41e586877d"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:14.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.10.8"},{"fixed":"13.10.11"},{"introduced":"14.4.3"},{"fixed":"14.4.7"},{"introduced":"14.6"},{"last_affected":"14.6"}]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"d24b588df8b5a92bef0214e24d3add8615e6188c"},{"fixed":"08e0887f0362b21614e6bfcb5be7e1f568659c41"},{"introduced":"f458acea03f9931f318892b20f4be69f2b743431"},{"fixed":"962ee4ac0352ab1a89cc779c29e81b0674d0203e"},{"introduced":"188d77c1a421e64ba71e2c3189e585e1fc54ac92"},{"fixed":"1943ea26c967ef868fb5f67c487d98d97cba0380"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:14.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.10.8"},{"fixed":"13.10.11"},{"introduced":"14.4.3"},{"fixed":"14.4.7"},{"introduced":"14.6"},{"last_affected":"14.6"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["14.6","xwiki-commons-13.10.10","xwiki-commons-14.4.6","xwiki-commons-14.4.5","xwiki-commons-14.4.4","xwiki-commons-13.10.9","xwiki-commons-14.4.3","xwiki-commons-13.10.8","xwiki-commons-14.6","xwiki-platform-14.4.6","xwiki-platform-14.4.5","xwiki-platform-14.4.4","xwiki-platform-14.4.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29506.json","vanir_signatures_modified":"2026-08-12T13:32:34Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["105201964671355131846929292978469665696","9141370093161360247023852902825816501","276698484318752629600384579683305212286","74727066728448478833029807160696679991","4531002543764502459188552604889152265","59348115275863142941578963662605444705","284106238438216861385481074090033998516","202125792419474882259852907899001988742","31036814902387404794806644621681912011","87896390684527757627012943064927617839"],"threshold":0.9},"id":"CVE-2023-29506-0a0d5b90","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandler.java"}},{"digest":{"function_hash":"259250603292762372071435436403739177942","length":764},"id":"CVE-2023-29506-1a7799d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandlerTest.java","function":"handleForgotUsername"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["333837371687335403038655646632368271587","322471603235072033359025686691845572083","285657594438487939294528518832836066624","252467953113046119743895566555696432483","405503113753934760506935605700825918","183023154997310394447362879453864155998","122742562168827293088327038393299611731","234304701566168278544084230158346681592","14343461921798507923617311646528531443","149446792529219615153142501685021787645","233933077768182912918242962850497287926","155681099482721782751564023498288494088","24347539411103939997957456250745781424","285563796423245892745779288016647610018","297658205955392371763498974488565107232","263572100187667573573342955066526503509","58975148321999911325292113347959031535","87221691737235509398048846725519556512","285206882378718838820173041136660173387","49887068424729508190692205618556526676","198808292575323673255983861159864594831","299609130126879767028664506979020047407","266923008138003996036736012538604470664","52019094538943582983063545863143125330","12601766032825209492719264670039146515","106008977246898217958188695954446741706","191369365569964437196436253404008526805","102784022670232590119883481164126181165","48096146621246234578613132547083120196","141124716784628640804632709362652374779","267213921207830434204776071410110400909","109754639994143263104908456491204350258","233825908038872426353696278308383365962","12601766032825209492719264670039146515","322399470899500000877664270905528824364","229147799604202575167218719069119907732","3922704288715925856310335444398355760"],"threshold":0.9},"id":"CVE-2023-29506-866c6848","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandlerTest.java"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandler.java","function":"handle"},"deprecated":false,"digest":{"function_hash":"109854637687187732252365675960948256594","length":374},"id":"CVE-2023-29506-99a9d0c3","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandlerTest.java","function":"handleResetPassword"},"deprecated":false,"digest":{"function_hash":"128749741452279076889621858980274722778","length":756},"id":"CVE-2023-29506-e2ff609d"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}]}