PT-2023-8595 · Xwiki · Xwiki Platform

Michael Hamann · Published 2023-12-15 · Updated 2023-12-19 · CVE-2023-50719

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 7.2-milestone-2 through 14.10.14 XWiki Platform versions 15.5.1 and earlier XWiki Platform versions prior to 15.7-rc-1

Description The Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This issue also affects configurations used by extensions that contain passwords like API keys, which would be disclosed as plain text. Approximately 2,208 instances are affected, mainly in Germany and the United States.

Recommendations For XWiki Platform versions 7.2-milestone-2 through 14.10.14, update to version 14.10.15 or later. For XWiki Platform versions 15.5.1 and earlier, update to version 15.5.2 or later. For XWiki Platform versions prior to 15.7-rc-1, update to version 15.7-rc-1 or later. As a temporary workaround, consider restricting access to user profiles and sensitive configurations until a patch is applied.

Exploit

Fix

Information Disclosure

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-359

CWE-200

CWE-312

Related Identifiers

BDU:2024-01248

CVE-2023-50719

GHSA-P6CP-6R35-32MH

Affected Products

Xwiki Platform

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50719.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p6cp-6r35-32mh · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea · Patch
• https://bdu.fstec.ru/vul/2024-01248 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50719 · Security Note
• https://jira.xwiki.org/browse/XWIKI-21208 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p6cp-6r35-32mh · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/63806 · Telegram Post
• https://t.me/cvenotify/64256 · Telegram Post
• https://twitter.com/CVEnew/status/1735946022189478384 · Twitter Post
• https://twitter.com/zoomeye_team/status/1737131333036712110 · Twitter Post