CVE-2023-35151
published 2023-06-23CVE-2023-35151: XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.72%
52.4th percentile
XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | — | — |
| xwiki | xwiki | — | — |
| xwiki | xwiki | >= 14.10 < 14.10.6 | 14.10.6 |
| xwiki | xwiki | >= 7.4 < 14.4.8 | 14.4.8 |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
XWiki Platform may show email addresses in clear in REST results
ghsa·2023-06-20
CVE-2023-35151 [HIGH] CWE-359 XWiki Platform may show email addresses in clear in REST results
XWiki Platform may show email addresses in clear in REST results
### Impact
Any user can call a REST endpoint and obtain the obfuscated passwords (even when the mail obfuscation is activated).
For instance, by calling http://localhost:8080/xwiki/rest/wikis/xwiki/spaces/XWiki/pages/U1/objects/XWiki.XWikiUsers/0 when user `U1` exists on wiki `xwiki`.
### Patches
The issue has been patched on XWiki 14.4.8, 14.10.6, and 15.1
### Workarounds
There is no known workaround. It is advised to upgrade to one of the patched versions.
### References
- https://jira.xwiki.org/browse/XWIKI-16138
- https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10ede
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.o
OSV
XWiki Platform may show email addresses in clear in REST results
osv·2023-06-20
CVE-2023-35151 [HIGH] XWiki Platform may show email addresses in clear in REST results
XWiki Platform may show email addresses in clear in REST results
### Impact
Any user can call a REST endpoint and obtain the obfuscated passwords (even when the mail obfuscation is activated).
For instance, by calling http://localhost:8080/xwiki/rest/wikis/xwiki/spaces/XWiki/pages/U1/objects/XWiki.XWikiUsers/0 when user `U1` exists on wiki `xwiki`.
### Patches
The issue has been patched on XWiki 14.4.8, 14.10.6, and 15.1
### Workarounds
There is no known workaround. It is advised to upgrade to one of the patched versions.
### References
- https://jira.xwiki.org/browse/XWIKI-16138
- https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10ede
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.o
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10edehttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8g9c-c9cm-9c56https://jira.xwiki.org/browse/XWIKI-16138https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10edehttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8g9c-c9cm-9c56https://jira.xwiki.org/browse/XWIKI-16138
2023-06-23
Published