CVE-2023-34465 json
XWiki Platform's Mail.MailConfig can be edited by any user with edit rights
published 2023-06-20 3 y ago modified 2026-06-17 4 mo ago also GHSA-g75c-cjr6-39mc , EUVD-2023-1797
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and view and edit the mail sending configuration, including the smtp domain name and credentials. The problem has been patched in XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, the rights of the `Mail.MailConfig` page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the `XWiki.XWikiAdminGroup` group).
Patch / fix
- maven org.xwiki.platform:xwiki-platform-mail-send-default 14.4.8, 14.10.6, 15.1
- xwiki xwiki 14.4.8, 14.10.6
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-20671 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-mail-send-default | >=11.8-rc-1, <14.4.8 >=14.5, <14.10.6 >=15.0-rc-1, <15.1 |
14.4.8 14.10.6 15.1 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
github.com
/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1
web, patch, vendor-advisory
-
github.com
/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4
web, patch, vendor-advisory
-
jira.xwiki.org
/browse/XWIKI-20519
web, issue-tracking, patch, vendor-advisory
-
jira.xwiki.org
/browse/XWIKI-20671
web, exploit, issue-tracking, patch, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-g75c-cjr6-39mc
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-34465
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2023-34465
- GitHub Advisory GHSA-g75c-cjr6-39mc
- NVD CVE-2023-34465
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.