PT-2023-25170 · Xwiki · Xwiki Platform

Vincent Massol · Published 2023-06-20 · Updated 2023-06-30 · CVE-2023-35151

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 7.3-milestone-1 through 14.4.7 XWiki Platform versions 14.4.8 is not affected, but versions prior to 14.4.8 are affected, the same applies to versions 14.10.6 and 15.1, so the correct format is: XWiki Platform versions prior to 14.4.8 XWiki Platform versions prior to 14.10.6 XWiki Platform versions prior to 15.1

However, since versions prior to 14.4.8 already include versions prior to 14.10.6 and 15.1, we can simplify to: XWiki Platform versions prior to 14.4.8

Description The issue allows any user to call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. For instance, by calling "http://localhost:8080/xwiki/rest/wikis/xwiki/spaces/XWiki/pages/U1/objects/XWiki.XWikiUsers/0" when user U1 exists on wiki xwiki.

Recommendations To resolve the issue, upgrade to one of the patched versions: 14.4.8, 14.10.6, or 15.1. As there is no known workaround, it is advised to upgrade to one of the patched versions.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-359

CWE-668

Related Identifiers

CVE-2023-35151

GHSA-8G9C-C9CM-9C56

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35151.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8g9c-c9cm-9c56 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10ede · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-16138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35151 · Security Note
• https://osv.dev/vulnerability/GHSA-8g9c-c9cm-9c56 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35151 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/65476 · Telegram Post
• https://t.me/cvenotify/53373 · Telegram Post