CVE-2023-32068
Published: 15 May 2023
Summary
CVE-2023-32068 is a medium-severity Open Redirect (CWE-601) vulnerability in Xwiki Xwiki. Its CVSS base score is 4.7 (Medium).
Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
XWiki Platform versions prior to 14.10.4 contain an open redirect vulnerability tracked as CVE-2023-32068 and CWE-601. The flaw stems from insufficient validation of well-known URL parameters that control redirection targets, allowing patterns such as http:example.com to bypass earlier partial fixes introduced in 12.10.7 and 13.3RC1.
An unauthenticated remote attacker can supply a crafted URL that causes a victim’s browser to be redirected to an arbitrary external site. Because the attack requires user interaction and yields only limited confidentiality impact with changed scope, the CVSS 3.1 base score is 4.7.
Official advisories and the accompanying patches in XWiki 14.10.4 and 15.0 state that all known redirect patterns have now been blocked and recommend immediate upgrade; no workarounds are provided.
EPSS rose from a low baseline to a peak of 0.8316 before receding to the current value of 0.3388, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1484
Vulnerability details
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability…
more
was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect. The issue has now been patched against all patterns that are known for performing redirects. This issue has been patched in XWiki 14.10.4 and 15.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.