Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-29517 Details

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user running the servlet engine (e.g. tomcat) running XWiki. The same vulnerability also allowed to perform internal requests to resources from the hosting server. The problem has been patched in XWiki 13.10.11, 14.10.1, 14.4.8, 15.0-rc-1. Users are advised to upgrade. It might be possible to workaround this vulnerability by running XWiki in a sandbox with a user with very low privileges on the machine.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m3c3-9qj7-7xmx	CVE	ExploitIssue TrackingPatchVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20324	CVE	ExploitIssue TrackingPatchVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20447	CVE	ExploitIssue TrackingPatchVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20449	CVE	ExploitIssue TrackingPatchVendor Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m3c3-9qj7-7xmx	[email protected]	ExploitIssue TrackingPatchVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20324	[email protected]	ExploitIssue TrackingPatchVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20447	[email protected]	ExploitIssue TrackingPatchVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20449	[email protected]	ExploitIssue TrackingPatchVendor Advisory

see all 8 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	[email protected]

Affected Products

Product	Versions
xwiki xwiki	< 13.10.11 >= 14.0, < 14.4.8 >= 14.5, < 14.10.1
CPE cpe:2.3:a:xwiki:xwiki:::::::: Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Apr 28, 2023	Initial Analysis	[email protected]