CVE-2023-29513
published 2023-04-19CVE-2023-29513: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.67%
47.5th percentile
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context. This vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1. There is no known workaround other than upgrading.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | < 14.10.1 | 14.10.1 |
| xwiki | xwiki-platform | < 14.10.1 | 14.10.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
osv·2023-04-20
CVE-2023-29513 [MEDIUM] xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
### Impact
If a guest has view rights on any document, it's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context.
To reproduce:
* On a wiki with view rights for guests but user registration disabled, open as guest /xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%2F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7Btemplate+name%3D%22distribution%2Ffirstadminuser.wiki%22+%2F%7D%7D where is the URL of your XWiki installation.
* Enter username and password of your choice.
* Click "Register and login"
### Patches
The vulnerability has been patched in XWiki 15.0-rc-1 and 14.
GHSA
xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
ghsa·2023-04-20
CVE-2023-29513 [MEDIUM] CWE-284 xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
### Impact
If a guest has view rights on any document, it's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context.
To reproduce:
* On a wiki with view rights for guests but user registration disabled, open as guest /xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%2F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7Btemplate+name%3D%22distribution%2Ffirstadminuser.wiki%22+%2F%7D%7D where is the URL of your XWiki installation.
* Enter username and password of your choice.
* Click "Register and login"
### Patches
The vulnerability has been patched in XWiki 15.0-rc-1 and 14.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp36-mjw5-fmgxhttps://jira.xwiki.org/browse/XWIKI-19852https://jira.xwiki.org/browse/XWIKI-20400https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp36-mjw5-fmgxhttps://jira.xwiki.org/browse/XWIKI-19852https://jira.xwiki.org/browse/XWIKI-20400
2023-04-19
Published