CVE-2023-32068: XWiki Platform open redirect via URL parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS 6.1 and required user interaction limit direct impact, but the high EPSS score and easy network reach keep it worth prompt patching.

What it is

XWiki Platform before 14.10.4 allows crafted URL parameters to redirect users to untrusted sites. A prior partial fix for 12.10.7 and 13.3RC1 left bypass patterns, such as URLs like `http:example.com`, that skip redirect checks. The flaw matters because it enables phishing and credential theft through trusted XWiki links.

Impact

An attacker can send a victim a trusted-looking XWiki URL that silently redirects to an attacker-controlled site, supporting phishing or malware delivery. The attacker gains no direct code execution or data access; the harm comes from user redirection.

Attack surface

Reachable over the network through crafted XWiki URLs containing known redirect parameters. No authentication is required, but the victim must click the link, so user interaction is needed.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record. EPSS is high at 0.5507 (98.98th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade XWiki Platform to 14.10.4 or 15.0, which fully patches all known redirect patterns.
• If immediate upgrade is not possible, restrict or filter outbound redirect parameters at the reverse proxy or WAF.
• Warn users about suspicious XWiki links and enforce link inspection in email and chat.
• Review any custom redirect handling or URL parameters added on top of XWiki for similar bypass patterns.

Detection

• Monitor web logs for XWiki requests with redirect-style parameters containing external or malformed URLs such as `http:example.com`.
• Alert on outbound redirects from the XWiki host to domains outside the organization.
• Track XWiki version inventory to identify hosts still below 14.10.4.
• Correlate user reports of unexpected redirects with access logs for the same session.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.