CVE-2023-29204 PoC — XWiki Commons 输入验证错误漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29204.yaml

Associated Vulnerability

Title:XWiki Commons 输入验证错误漏洞 (CVE-2023-29204)
Description:XWiki Commons是其他几个顶级 XWiki 项目共有的技术库。 XWiki Commons 存在输入验证错误漏洞，该漏洞源于通过使用特殊 URL 可以绕过为避免开放重定向而实施的现有安全措施。

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

File Snapshot


 id: CVE-2023-29204

info:
  name: XWiki - Open Redirect
  author: ritikchaddha
  severity: medium
  

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!