CVE-2023-50720

published 2023-12-15

CVE-2023-50720: XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of…

Priority P3 56 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

EXPLOIT

XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
xwiki	xwiki	< 14.10.5	14.10.5
xwiki	xwiki	—	—
xwiki	xwiki	—	—
xwiki	xwiki	>= 15.0 < 15.5.2	15.5.2
xwiki	xwiki-platform	< 14.10.15	14.10.15
xwiki	xwiki-platform	—	—
xwiki	xwiki-platform	—	—

Detection & IOCs extracted from sources · hover to see the quote

sigma↗

objcontent:email* search query against XWiki Solr endpoint

yara

XWiki.XWikiUsers[0] AND email_checked in HTTP 200 response

• → Search for Solr queries containing 'objcontent:email*' in HTTP request logs targeting XWiki instances — this is the proof-of-concept query used to exfiltrate obfuscated email addresses via the Solr-based search interface. ↗
• → Detect HTTP 200 responses from XWiki that contain both 'XWiki.XWikiUsers[0]' and 'email_checked' strings, indicating successful disclosure of user email address properties via Solr search.

• · The vulnerability only manifests when email address obfuscation is enabled in XWiki configuration — without obfuscation enabled, email addresses are already public and the Solr indexing behavior is expected. ↗
• · Fixed versions are 14.10.15, 15.5.2, and 15.7-rc-1. The fix works by not indexing email address properties when obfuscation is enabled. There are no known workarounds. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200