CVE-2023-29506
Published: 16 April 2023
Summary
CVE-2023-29506 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Xwiki Xwiki. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
XWiki Commons, the technical libraries shared across multiple XWiki projects, contain a cross-site scripting vulnerability tracked as CVE-2023-29506 and CWE-79. The flaw allows code injection through the URLs of authenticated endpoints and was addressed in the releases XWiki 13.10.11, 14.4.7, and 14.10.
An unauthenticated remote attacker can exploit the issue by supplying a crafted URL that triggers script execution when a victim interacts with it. Successful exploitation yields limited impacts on confidentiality and integrity, consistent with the CVSS 5.4 rating that requires user interaction but no prior authentication.
Public advisories and patches published via the XWiki Jira tracker and GitHub Security Advisories GHSA-jjm5-5v9v-7hx2 document the affected code paths and the commits that restrict URL handling to prevent injection.
EPSS scores for the CVE rose from lower values to a peak of 0.4132 on 2025-12-11 before receding to the current 0.1150, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1341
Vulnerability details
XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.