CVE-2023-29513: Improper Access Control

April 20, 2023

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It’s possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1. There is no known workaround other than upgrading.

References

github.com/advisories/GHSA-fp36-mjw5-fmgx
github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp36-mjw5-fmgx
jira.xwiki.org/browse/XWIKI-19852
jira.xwiki.org/browse/XWIKI-20400
nvd.nist.gov/vuln/detail/CVE-2023-29513

Code Behaviors & Features

Detect and mitigate CVE-2023-29513 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →