CVE-2023-29204

Deeper analysis

XWiki Commons, the shared technical libraries used across multiple XWiki projects, contain an open redirect flaw tracked as CVE-2023-29204. The code intended to block external redirects could be bypassed by supplying protocol-relative URLs such as //mydomain.com or malformed single-slash variants such as http:/mydomain.com, allowing an attacker-controlled destination to be reached.

An unauthenticated remote attacker can craft a malicious link that, once clicked by a victim, redirects the user’s browser to an arbitrary external site. Because the CVSS vector includes user interaction and changed scope, the primary impact is a low-severity confidentiality exposure that can facilitate phishing or further social-engineering attacks.

The project addressed the issue in the releases 13.10.10, 14.4.4, and 14.8RC1; the corresponding commits and the GitHub Security Advisory GHSA-xwph-x6xj-wggv document the fix and recommend upgrading to a patched version.

EPSS for the CVE rose from a low baseline to a peak of 0.0983 on 2025-12-11 before receding to the current value of 0.0102, indicating a measurable increase in exploitation interest after public disclosure.