CVE-2023-35151

XWiki Platform may show email addresses in clear in REST results

State: Published
Severity: 7.5 High
Published: Jun 23, 2023
Updated: Nov 27, 2024
Reserved: Jun 14, 2023

Description

XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

Affected Products

Product	Versions
xwiki-platformxwiki	>= 7.3-milestone-1, < 14.4.8Affected >= 14.5, < 14.10.6Affected >= 15.0-rc-1, < 15.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.