PT-2023-4816 · Xwiki · Xwiki Platform
Floerer
·
Published
2023-06-20
·
Updated
2023-06-30
·
CVE-2023-34467
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
XWiki Platform versions 3.5-milestone-1 through 14.4.7
XWiki Platform versions 14.5.0 through 14.10.3
XWiki Platform versions 15.0-rc-0
Description
The mail obfuscation configuration was not fully taken into account, allowing users to infer the mail content. While the mail displayed to the end user was obfuscated, the rest response was also containing the mail unobfuscated, and users were able to filter and sort on the unobfuscated. The consequence was the possibility to retrieve the email addresses of all users even when obfuscated.
Recommendations
For XWiki Platform versions 3.5-milestone-1 through 14.4.7, update to version 14.4.8 or later.
For XWiki Platform versions 14.5.0 through 14.10.3, update to version 14.10.4 or later.
For XWiki Platform versions 15.0-rc-0, update to version 15.0-rc-1 or later.
As a temporary workaround, consider modifying the page
XWiki.LiveTableResultsMacros following the provided patch.Exploit
Fix
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Xwiki Platform