cve.bz

CVE-2023-26476

7.5 highEPSS 2.2%

High (7.5) in xwiki xwiki. EPSS 2.2% chance of exploitation in the next 30 days. Fixed in org.xwiki.platform:xwiki-platform-livetable-ui 13.10.9, 13.4.4, 14.7-rc-1.

XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWEs
CWE-307, CWE-200
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-5cf8-vrr8-8hjmMavenorg.xwiki.platform:xwiki-platform-livetable-ui>=3.2-m3 <13.4.413.4.4
GHSA-5cf8-vrr8-8hjmMavenorg.xwiki.platform:xwiki-platform-wiki-ui-mainwiki>=3.2-m3 <13.4.413.4.4
GHSA-5cf8-vrr8-8hjmMavenorg.xwiki.platform:xwiki-platform-livetable-ui>=13.5.0 <13.10.913.10.9
GHSA-5cf8-vrr8-8hjmMavenorg.xwiki.platform:xwiki-platform-wiki-ui-mainwiki>=13.5.0 <13.10.913.10.9
GHSA-5cf8-vrr8-8hjmMavenorg.xwiki.platform:xwiki-platform-livetable-ui>=14.0.0 <14.7-rc-114.7-rc-1
GHSA-5cf8-vrr8-8hjmMavenorg.xwiki.platform:xwiki-platform-wiki-ui-mainwiki>=14.0.0 <14.7-rc-114.7-rc-1

References

Check your stackJSON