CVE-2023-29513
Java vulnerability analysis and mitigation

Overview

XWiki Platform, a generic wiki platform offering runtime services for applications, was found to contain a vulnerability (CVE-2023-29513) that allows unauthorized user creation. The vulnerability affects versions from 8.0-rc-1 up to versions before 15.0-rc-1 and 14.10.1. If a guest has view rights on any document, they can exploit the vulnerability to create new users even when registration is disabled by using the distribution/firstadminuser.wiki template in the wrong context (GitHub Advisory).

Technical details

The vulnerability exists in the template macro functionality of XWiki Platform. An attacker can exploit this by accessing a specific URL with crafted parameters that invoke the template macro with the distribution/firstadminuser.wiki template. Starting with XWiki 14.5 (or CKEditor contrib extension 1.64.3), a valid CSRF token is required for exploitation. The vulnerability has been assigned a CVSS v3.1 score of 5.0 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating it requires network access and low privileges but can affect resources beyond its security scope (GitHub Advisory).

Impact

The vulnerability allows unauthorized users to bypass registration restrictions and create new user accounts without proper validation. This could lead to unauthorized access to the system and potential privilege escalation. The vulnerability specifically affects wikis that have view rights for guests but have user registration disabled (GitHub Advisory).

Mitigation and workarounds

The vulnerability has been patched in XWiki versions 15.0-rc-1 and 14.10.1. There are no known workarounds other than upgrading to a patched version. Users are strongly advised to upgrade to these versions or later to address the security issue (GitHub Advisory).

Additional resources


SourceThis report was generated using AI

Related Java vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-10050HIGH8.7
  • Java logoJava
  • kafka-4.0
NoYesAug 04, 2026
CVE-2026-59920MEDIUM6.5
  • Java logoJava
  • netty
NoYesJul 29, 2026
CVE-2026-59898MEDIUM6.3
  • Java logoJava
  • apache-nifi-registry
NoYesJul 29, 2026
CVE-2026-59919MEDIUM5.5
  • Java logoJava
  • apache-pulsar-fips-4.2
NoYesJul 29, 2026
CVE-2026-53573MEDIUM4.8
  • Java logoJava
  • org.geonetwork-opensource:geonetwork
NoYesJul 31, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management