CVE-2023-50719
published 2023-12-15CVE-2023-50719: XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki…
PriorityP276high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
83.55%
99.6th percentile
XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text. This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | — | — |
| xwiki | xwiki | — | — |
| xwiki | xwiki | — | — |
| xwiki | xwiki | >= 15.0 < 15.5.2 | 15.5.2 |
| xwiki | xwiki | >= 7.3 < 14.10.5 | 14.10.5 |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
otherXWikiUsers[0].password
- →Look for Solr search queries containing the field name 'XWikiUsers[0].password' in HTTP requests, which indicates exploitation of the XWiki Solr-based search password hash disclosure vulnerability.
- →A successful exploit returns HTTP 200 status code when querying for the password field via XWiki's Solr search endpoint.
- ·The vulnerability affects XWiki versions starting from 7.2-milestone-2 up to (but not including) 14.10.15, 15.5.2, and 15.7-rc-1. All user profiles are public by default, meaning any unauthenticated or low-privileged user with view access can exploit this. ↗
- ·Beyond user password hashes, extension configurations containing secrets such as API keys that are viewable to the attacker are also exposed as plain text via this vulnerability. ↗
- ·There are no known workarounds; patching to XWiki 14.10.15, 15.5.2, or 15.7RC1 is the only remediation. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ghsa6.5MEDIUM
osv6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Solr search discloses password hashes of all users
osv·2023-12-16·CVSS 6.5
CVE-2023-50719 [MEDIUM] Solr search discloses password hashes of all users
Solr search discloses password hashes of all users
### Impact
The Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. To reproduce, it is sufficient to search for `propertyvalue:?* AND reference:*.password` and then deselect the "Document" property under "Result type" in the "Refine your search" widget at the right of the search results. If this displays any passwords or password hashes, the installation is vulnerable.
By default, passwords in XWiki are salted and hashed with SHA-512. On XWiki versions affected by [CVE-2022-41933](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q2hm-2h45-v5g3), passwords are stored in plain text if they have been set usi
GHSA
Solr search discloses password hashes of all users
ghsa·2023-12-16·CVSS 6.5
CVE-2023-50719 [MEDIUM] CWE-200 Solr search discloses password hashes of all users
Solr search discloses password hashes of all users
### Impact
The Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. To reproduce, it is sufficient to search for `propertyvalue:?* AND reference:*.password` and then deselect the "Document" property under "Result type" in the "Refine your search" widget at the right of the search results. If this displays any passwords or password hashes, the installation is vulnerable.
By default, passwords in XWiki are salted and hashed with SHA-512. On XWiki versions affected by [CVE-2022-41933](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q2hm-2h45-v5g3), passwords are stored in plain text if they have been set usi
No detection rules found.
Nuclei
XWiki < 4.10.15 - Sensitive Information Disclosure
nuclei·CVSS 7.5
CVE-2023-50719 [HIGH] XWiki < 4.10.15 - Sensitive Information Disclosure
XWiki "
- "XWikiUsers[0].password"
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022100d2a5727e5fa076916055f87e795602872973de6ad4496ab22481411948cc6ae90220524c2370cb40f665668a57a219e24054b2469aaf4c6df96a4accc7b9c23a8be6:922c64590222798bb761d5b6d8e72950
https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eeahttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p6cp-6r35-32mhhttps://jira.xwiki.org/browse/XWIKI-21208https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eeahttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p6cp-6r35-32mhhttps://jira.xwiki.org/browse/XWIKI-21208
2023-12-15
Published