CVE-2023-34466

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 5.0-milestone-1, < 14.4.8; >= 14.5, < 14.10.4

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7f2f-pcv3-j2r7Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20002Exploit, Issue Tracking, Patch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7f2f-pcv3-j2r7Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20002Exploit, Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-344677.5XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mai CVE-2023-344688.8The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authori CVE-2023-344694.6AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. A successful expl CVE-2023-34477.6The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4 CVE-2023-344707.8AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit CVE-2023-344718.1AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentic CVE-2023-344726.5AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A succ CVE-2023-344738.8AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulne CVE-2023-344745.5A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could tri CVE-2023-344755.5A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user CVE-2023-344769.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-344779.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.