CVE-2023-34467 json
XWiki Platform may retrieve email addresses of all users
published 2023-06-20 3 y ago modified 2026-09-10 1 mo ago also GHSA-7vr7-cghh-ch63 , EUVD-2023-1738
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end user was obfuscated, the rest response was also containing the mail unobfuscated and users were able to filter and sort on the unobfuscated, allowing them to infer the mail content. The consequence was the possibility to retrieve the email addresses of all users even when obfuscated. This has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-livetable-ui 14.4.8, 14.10.4
- xwiki xwiki 14.4.8, 14.10.4
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-20333 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-livetable-ui | >=3.5-milestone-1, <14.4.8 >=14.5, <14.10.4 |
14.4.8 14.10.4 |
Affected products
- xwiki xwiki-platform
Classification
References
-
github.com
/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a#diff-5a739e5865b1f1ad9d79b724791be51b009
web, patch, vendor-advisory
-
jira.xwiki.org
/browse/XWIKI-20333
web, exploit, issue-tracking, patch, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-7vr7-cghh-ch63
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-34467
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2023-34467
- GitHub Advisory GHSA-7vr7-cghh-ch63
- NVD CVE-2023-34467
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.