CVE-2023-29204

XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

• CWE-601

• https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cfPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggvExploit, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-10309Exploit, Issue Tracking
• https://jira.xwiki.org/browse/XWIKI-19994Exploit, Issue Tracking
• https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cfPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggvExploit, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-10309Exploit, Issue Tracking
• https://jira.xwiki.org/browse/XWIKI-19994Exploit, Issue Tracking

Published

Apr 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29199There exists a vulnerability in source code transformer (exc…10
• CVE-2023-2920Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-29200Contao is an open source content management system. Prior to…6.5
• CVE-2023-29201XWiki Commons are technical libraries common to several othe…9
• CVE-2023-29202XWiki Commons are technical libraries common to several othe…9
• CVE-2023-29203XWiki Commons are technical libraries common to several othe…5.3
• CVE-2023-29205XWiki Commons are technical libraries common to several othe…5.4
• CVE-2023-29206XWiki Commons are technical libraries common to several othe…5.4
• CVE-2023-29207 XWiki Commons are technical libraries common to several oth…9
• CVE-2023-29208XWiki Commons are technical libraries common to several othe…7.5
• CVE-2023-29209XWiki Commons are technical libraries common to several othe…8.8
• CVE-2023-2921The Short URL WordPress plugin through 1.6.8 does not proper…8.8