CVE-2023-34465

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and view and edit the mail sending configuration, including the smtp domain name and credentials. The problem has been patched in XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, the rights of the `Mail.MailConfig` page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the `XWiki.XWikiAdminGroup` group).

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 11.8-rc-1, < 14.4.8; >= 14.5, < 14.10.6; >= 15.0-rc-1, < 15.1

References

https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1Patch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4Patch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g75c-cjr6-39mcVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20519Issue Tracking, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20671Exploit, Issue Tracking, Patch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1Patch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4Patch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g75c-cjr6-39mcVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20519Issue Tracking, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20671Exploit, Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-344664.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 CVE-2023-344677.5XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mai CVE-2023-344688.8The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authori CVE-2023-344694.6AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. A successful expl CVE-2023-34477.6The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4 CVE-2023-344707.8AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit CVE-2023-344718.1AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentic CVE-2023-344726.5AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A succ CVE-2023-344738.8AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulne CVE-2023-344745.5A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could tri CVE-2023-344755.5A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user CVE-2023-344769.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.