CVE-2023-29513: Users can be created even when registration is disabled without validation via the template macro in xwiki-platform
First published: Tue Apr 18 2023(Updated: )
### Impact If a guest has view rights on any document, it's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context. To reproduce: * On a wiki with view rights for guests but user registration disabled, open as guest <server>/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%2F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7Btemplate+name%3D%22distribution%2Ffirstadminuser.wiki%22+%2F%7D%7D where <server> is the URL of your XWiki installation. * Enter username and password of your choice. * Click "Register and login" ### Patches The vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1. ### Workarounds There is no known workaround other than upgrading. ### References https://jira.xwiki.org/browse/XWIKI-19852 https://jira.xwiki.org/browse/XWIKI-20400 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xwiki Xwiki | <14.10.1 | |
| maven/org.xwiki.platform:xwiki-platform-web-templates | >=8.0-rc-1<14.10.1 | 14.10.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-29513?
CVE-2023-29513 is a vulnerability in XWiki Platform that allows an attacker to create a new user in the wrong context if the guest has view rights on any document.
What is the severity of CVE-2023-29513?
The severity of CVE-2023-29513 is medium with a CVSS score of 4.3.
How does CVE-2023-29513 affect XWiki Platform?
CVE-2023-29513 affects XWiki Platform versions up to 14.10.1.
Has CVE-2023-29513 been patched?
Yes, CVE-2023-29513 has been patched in XWiki 15.0-rc1 and later versions.
What can I do to fix CVE-2023-29513?
To fix CVE-2023-29513, it is recommended to update XWiki Platform to version 15.0-rc1 or later.
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-fp36-mjw5-fmgx
- alias/CVE-2023-29513
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/description
- agent/event
- agent/tags
- agent/first-publish-date
- vendor/xwiki
- canonical/xwiki xwiki
- package-manager/maven