PT-2023-20667 · Unknown · Xwiki Platform

Michael Hamann · Publicado 2023-03-02 · Atualizado 2023-03-14 · CVE-2023-26476

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 3.2-m3 through 13.4.3 XWiki Platform versions 3.2-m3 through 13.10.8 XWiki Platform versions prior to 14.7-rc-1

Description XWiki Platform is a generic wiki platform. The issue allows users to deduce the content of the password fields by repeated calls to LiveTableResults and WikisLiveTableResultsMacros.

Recommendations For XWiki Platform versions 3.2-m3 and later, apply the patch manually on LiveTableResults and WikisLiveTableResultsMacros. For XWiki Platform versions prior to 13.4.4, upgrade to version 13.4.4 or higher. For XWiki Platform versions prior to 13.10.9, upgrade to version 13.10.9 or higher. For XWiki Platform versions prior to 14.7-rc-1, upgrade to version 14.7-rc-1 or higher.

Exploit

Correção

Information Disclosure

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-200

CWE-307

Identificadores relacionados

CVE-2023-26476

GHSA-5CF8-VRR8-8HJM

Produtos afetados

Xwiki Platform

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26476.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19949 · Exploit
• https://github.com/xwiki/xwiki-platform · Nota
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5cf8-vrr8-8hjm · Aviso do Fabricante
• https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-26476 · Nota de Segurança
• https://t.me/cvenotify/45376 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-5cf8-vrr8-8hjm · Aviso do Fabricante
• https://t.me/cibsecurity/59339 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26476 · Aviso do Fabricante