PT-2023-8595 · Xwiki · Xwiki Platform

Michael Hamann · Publicado 2023-12-15 · Atualizado 2023-12-19 · CVE-2023-50719

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 7.2-milestone-2 through 14.10.14 XWiki Platform versions 15.5.1 and earlier XWiki Platform versions prior to 15.7-rc-1

Description The Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This issue also affects configurations used by extensions that contain passwords like API keys, which would be disclosed as plain text. Approximately 2,208 instances are affected, mainly in Germany and the United States.

Recommendations For XWiki Platform versions 7.2-milestone-2 through 14.10.14, update to version 14.10.15 or later. For XWiki Platform versions 15.5.1 and earlier, update to version 15.5.2 or later. For XWiki Platform versions prior to 15.7-rc-1, update to version 15.7-rc-1 or later. As a temporary workaround, consider restricting access to user profiles and sensitive configurations until a patch is applied.

Exploit

Correção

Information Disclosure

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-359

CWE-200

CWE-312

Identificadores relacionados

BDU:2024-01248

CVE-2023-50719

GHSA-P6CP-6R35-32MH

Produtos afetados

Xwiki Platform

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50719.json · Exploit
• https://github.com/xwiki/xwiki-platform · Nota
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p6cp-6r35-32mh · Aviso do Fabricante
• https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea · Correção
• https://bdu.fstec.ru/vul/2024-01248 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-50719 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50719 · Nota de Segurança
• https://jira.xwiki.org/browse/XWIKI-21208 · Aviso do Fabricante
• https://t.me/cvenotify/63806 · Publicação no Telegram
• https://t.me/cvenotify/64256 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-p6cp-6r35-32mh · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1735946022189478384 · Publicação no Twitter
• https://twitter.com/zoomeye_team/status/1737131333036712110 · Publicação no Twitter