Patchfirst
Patchfirst
CVE-2023-32068 Public exploit Medium · 4.7 EPSS 55.1%

URL Redirection to Untrusted Site in XWiki

xwiki · xwiki-platform

Summary

The flaw is an open redirect in the xwiki-platform component of XWiki Platform, where well-known URL parameters can be abused to redirect users to untrusted sites, because an earlier partial fix left URL patterns such as http:example.com able to bypass the redirect checks. An attacker can send a crafted link to a user who must click it (user interaction required), with no authentication or prior network access needed, to send that user to an external site of the attacker's choosing.

Official description · CVE.org

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect. The issue has now been patched against all patterns that are known for performing redirects. This issue has been patched in XWiki 14.10.4 and 15.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Breakdown
28.1 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 15 May 2023. No public exploit code or confirmed exploitation is recorded.

See the family tree

3 related vulnerabilities in the same code over 15 months. The latest fix listed for xwiki-platform-oldcore is 15.2-rc-1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2022-23618Open Redirect in xwiki-platform9 Feb 2022
  2. relatedHigh

    Why these are linked:

    CVE-2023-29204URL Redirection to Untrusted Site ('Open Redirect') in…15 Apr 2023
  3. same family
    This CVECVE-2023-32068URL Redirection to Untrusted Site in XWiki15 May 2023

Fixes in xwiki-platform-oldcoreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 14.10CVE-2023-2950716 Apr 2023
  2. 14.10.2CVE-2023-2952318 Apr 2023
  3. 14.10.3CVE-2023-2952618 Apr 2023
  4. 14.10.4CVE-2023-3206815 May 2023
  5. 14.10.17CVE-2024-216488 Jan 2024
  6. 15.1-rc-1CVE-2023-3515723 Jun 2023
  7. 15.2-rc-1CVE-2023-3646829 Jun 2023
  8. 15.2-rc-1CVE-2023-462437 Nov 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-oldcore.

Mavenorg.xwiki.platform:xwiki-platform-oldcoreGHSA-6gvj-8vc5-8v3j

Upgrade to 14.10.4

Still affected on this line by CVE-2025-54125 (fixed in 16.4.7, a newer line).

Set the version to 14.10.4 or later in your pom.xml or build.gradle.

The first fix for CVE-2023-32068.

Affected versions

If you runUpgrade to
All versions before 14.10.414.10.4

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-6gvj-8vc5-8v3j

x_refsource_MISC 3

github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1ejira.xwiki.org/browse/XWIKI-20096jira.xwiki.org/browse/XWIKI-20549
↑ ↓ chooseEnter openEsc close