xwiki/xwiki-platform · Security
XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor
- GHSA ID
- GHSA-5cf8-vrr8-8hjm
- CVE ID
- CVE-2023-26476
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Impact
Users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros.
Patches
The issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9.
Workarounds
The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, and 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on LiveTableResults and WikisLiveTableResultsMacros.
References
- Jira: https://jira.xwiki.org/browse/XWIKI-19949
- Patch: https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CWE-307 · Improper Restriction of Excessive Authentication Attempts
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5cf8-vrr8-8hjm ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-26476 ↗
- https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8 ↗
- https://jira.xwiki.org/browse/XWIKI-19949 ↗
- https://github.com/advisories/GHSA-5cf8-vrr8-8hjm ↗