CVE-2023-34467

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end user was obfuscated, the rest response was also containing the mail unobfuscated and users were able to filter and sort on the unobfuscated, allowing them to infer the mail content. The consequence was the possibility to retrieve the email addresses of all users even when obfuscated. This has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-402 CWE-668

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 3.5-milestone-1, < 14.4.8; >= 14.5, < 14.10.4

References

https://github.com/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949aPatch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vr7-cghh-ch63Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20333Exploit, Issue Tracking, Patch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949aPatch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vr7-cghh-ch63Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20333Exploit, Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-344688.8The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authori CVE-2023-344694.6AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. A successful expl CVE-2023-34477.6The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4 CVE-2023-344707.8AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit CVE-2023-344718.1AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentic CVE-2023-344726.5AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A succ CVE-2023-344738.8AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulne CVE-2023-344745.5A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could tri CVE-2023-344755.5A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user CVE-2023-344769.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-344779.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-344789.8Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when us