PT-2023-8490 · Xwiki · Xwiki Platform

Ilie Andriuta · Published 2023-07-27 · Updated 2024-03-18 · CVE-2023-38509

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 3.5-milestone-1 through 14.10.8 XWiki Platform versions 15.3-rc-1 and earlier

Description The issue is related to the disclosure of information in the error data area of the XWiki Platform, specifically in the org.xwiki.platform:xwiki-platform-livetable-ui component. This could allow a remote attacker to gain unauthorized access to protected information. The mail obfuscation configuration was not fully taken into account, making it possible to still obtain obfuscated emails.

Recommendations For XWiki Platform versions 3.5-milestone-1 through 14.10.8, update to version 14.10.9 or later. For XWiki Platform versions 15.3-rc-1 and earlier, update to version 15.3-rc-1 or later. As a temporary workaround, consider modifying the page XWiki.LiveTableResultsMacros following the provided patch.

Exploit

Fix

Weakness Enumeration

CWE-402

Related Identifiers

BDU:2024-00971

CVE-2023-38509

GHSA-G9W4-PRF3-M25G

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38509.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20601 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-38509 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38509 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g9w4-prf3-m25g · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00971 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g9w4-prf3-m25g · Note
• https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0 · Note
• https://t.me/cvenotify/74167 · Telegram Post