{"id":"CVE-2023-29507","summary":"org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors","details":"XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.","aliases":["GHSA-pwfv-3cvg-9m4c"],"modified":"2026-08-12T13:32:34.262922Z","published":"2023-04-16T06:52:19.020Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-648"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29507.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20380"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29507.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pwfv-3cvg-9m4c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29507"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"61c53b88c2b3fbec007b847320a19b22011a60c0"},{"fixed":"5d5ba1ade22d91d0fd6bf3dd20bb96fa64264a97"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"14.4.1"},{"fixed":"14.4.7"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"fb6bda1d09d5d4395a2be4706349157f4c72e211"},{"fixed":"962ee4ac0352ab1a89cc779c29e81b0674d0203e"},{"fixed":"905cdd7c421dbf8c565557cdc773ab1aa9028f83"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"14.4.1"},{"fixed":"14.4.7"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-14.4.6","xwiki-commons-14.4.5","xwiki-commons-14.4.4","xwiki-commons-14.4.3","xwiki-commons-14.4.2","xwiki-commons-14.4.1","xwiki-platform-14.4.6","xwiki-platform-14.4.5","xwiki-platform-14.4.4","xwiki-platform-14.4.3","xwiki-platform-14.4.2","xwiki-platform-14.4.1"],"database_specific":{"vanir_signatures":[{"id":"CVE-2023-29507-0899862c","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/api/DocumentTest.java"},"deprecated":false,"digest":{"line_hashes":["285397197873779972489957272834272170973","79969548012995274950373936628247338239","5222656509254680006471254636348292317","317674232405731194166582250129789568940","1786345460590735685928867063035927326","124193562424752326028148407017570386872","34784887736311344661036271570136980198","288737256091871294421441393879995500056","222327388409457927178832144348413986168","204466045014135139392986802513684113583","162160811881079429794926340107139182418","130393197160870855745327643197966112588","135560433761557512860871916202820089593","183561585768336160587504157042675293914","69076345538002824735413467080161712207","300158233821252551245839735844162920919","254778949535633233792066214517092012472","118372129799966657123530356248044351528"],"threshold":0.9}},{"deprecated":false,"digest":{"length":599,"function_hash":"191589447231400789890908486926056862646"},"id":"CVE-2023-29507-2e3c4680","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java","function":"save"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java","function":"getAuthors"},"deprecated":false,"digest":{"function_hash":"205044551856414866438662909025940991316","length":50},"id":"CVE-2023-29507-4dcc784c","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["136203542706314606100395643333948229707","222622313404907064122408188724895148092","18601401601876166736719796137049916700","6513534256860196359361987053334192121","253302169299365199340334301323888516355","95832038197203841806569357737992364948","146976295459013726332819977188799749200","31229928828224466808632066724905270515","67824579202156303980569197253918802680","40140165396904336409190860670917989824","198983596758786102153632833518692590512","307761946409823186425836376523147927382","73333133991199364308798064297134169434","97833740929340090853290254486830155459","128440889546507359135049613005307558666","188841850327438289931794351529281637178","85212960207557622921633149994572375235","97397019122705273094435997209017938233","206597587046559674257344140963915447804","280838880231311263623839868505682163170","128518389437398849439910757302426350223"],"threshold":0.9},"id":"CVE-2023-29507-6949780c","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java","function":"saveAsAuthor"},"deprecated":false,"digest":{"function_hash":"122574119866430752981632920513731251176","length":650},"id":"CVE-2023-29507-b711e0ba","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29507.json","vanir_signatures_modified":"2026-08-12T13:32:34Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}