CVE-2023-50720

2023-12-1519:15:09

CWE-200

GitHub_M

web.nvd.nist.gov

xwiki

platform

solr-based search

vulnerability

email addresses

obfuscation

nvd

cve-2023-50720

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.009

Percentile

83.2%

JSON

XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for objcontent:email* using XWiki’s regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.

Affected configurations

Nvd

Vulners

Node

xwikixwikiRange<14.10.5

xwikixwikiRange15.0–15.5.2

xwikixwikiMatch15.6-

xwikixwikiMatch15.6rc1

xwikixwikiMatch15.7rc1

VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwikixwiki15.6cpe:2.3:a:xwiki:xwiki:15.6:-:*:*:*:*:*:*
xwikixwiki15.6cpe:2.3:a:xwiki:xwiki:15.6:rc1:*:*:*:*:*:*
xwikixwiki15.7cpe:2.3:a:xwiki:xwiki:15.7:rc1:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::
xwiki	xwiki	15.6	cpe:2.3:a:xwiki:xwiki:15.6:-::::::
xwiki	xwiki	15.6	cpe:2.3:a:xwiki:xwiki:15.6:rc1::::::
xwiki	xwiki	15.7	cpe:2.3:a:xwiki:xwiki:15.7:rc1::::::

CNA Affected

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": "< 14.10.15",
        "status": "affected"
      },
      {
        "version": ">= 15.0-rc-1, < 15.5.2",
        "status": "affected"
      },
      {
        "version": ">= 15.6-rc-1, < 15.7-rc-1",
        "status": "affected"
      }
    ]
  }
]