PT-2023-20667 · Unknown · Xwiki Platform

Michael Hamann · Published 2023-03-02 · Updated 2023-03-14 · CVE-2023-26476

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 3.2-m3 through 13.4.3 XWiki Platform versions 3.2-m3 through 13.10.8 XWiki Platform versions prior to 14.7-rc-1

Description XWiki Platform is a generic wiki platform. The issue allows users to deduce the content of the password fields by repeated calls to LiveTableResults and WikisLiveTableResultsMacros.

Recommendations For XWiki Platform versions 3.2-m3 and later, apply the patch manually on LiveTableResults and WikisLiveTableResultsMacros. For XWiki Platform versions prior to 13.4.4, upgrade to version 13.4.4 or higher. For XWiki Platform versions prior to 13.10.9, upgrade to version 13.10.9 or higher. For XWiki Platform versions prior to 14.7-rc-1, upgrade to version 14.7-rc-1 or higher.

Exploit

Fix

Information Disclosure

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-200

CWE-307

Related Identifiers

CVE-2023-26476

GHSA-5CF8-VRR8-8HJM

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26476.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19949 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5cf8-vrr8-8hjm · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-26476 · Security Note
• https://osv.dev/vulnerability/GHSA-5cf8-vrr8-8hjm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26476 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/45376 · Telegram Post
• https://t.me/cibsecurity/59339 · Telegram Post