CVE-2023-29203

LOW

XWiki 13.9-13.10.8 - Unauthorized Exposure of Private User Information via uorgsuggest.vm

Title source: llm

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with `uorgsuggest.vm`. This issue only concerns hidden users from main wiki. Note that the disclosed information are the username and the first and last name of users, no other information is leaked. The problem has been patched on XWiki 13.10.8, 14.4.3 and 14.7RC1.

References (3)

Core 3

Core References

Exploit, Patch, Vendor Advisory x_refsource_confirm

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vvp7-r422-rx83

Vendor Advisory x_refsource_misc

https://github.com/xwiki/xwiki-platform/pull/1883

Exploit, Issue Tracking x_refsource_misc

https://jira.xwiki.org/browse/XWIKI-20007

Scores

CVSS v3 3.7

EPSS 0.0069

EPSS Percentile 47.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-359 CWE-668

Status published

Products (3)

org.xwiki.platform/xwiki-platform-web-templates 13.9-rc-1 - 13.10.8Maven

xwiki/xwiki 13.9 rc1

xwiki/xwiki 13.9 - 13.10.8

Published Apr 15, 2023

Tracked Since Feb 18, 2026