Riskcovery

CVE-2023-38509

XWiki Platform's obfuscated email addresses should not be sorted

State
Published
Severity
4.3 Medium
Published
Jul 27, 2023
Updated
Aug 2, 2024
Reserved
Jul 18, 2023

Read the record on cve.org

Description

XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10.9 and 15.3-rc-1, the mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. This has been patched in XWiki 14.10.9 and XWiki 15.3-rc-1. A workaround is to modify the page `XWiki.LiveTableResultsMacros` following the patch.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NGitHub_M

Weaknesses

  • CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')

Affected Products

ProductVersions
xwiki-platformxwiki
  • >= 3.5-milestone-1, < 14.10.9Affected
  • >= 15.0, < 15.3-rc-1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.