CVE-2023-34466

MEDIUM

XWiki 5.0.1-14.4.7 - Unauthorized Information Disclosure via Tags API

Title source: llm
STIX 2.1

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.

References (2)

Core 2
Core References
Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://jira.xwiki.org/browse/XWIKI-20002

Scores

CVSS v3 4.3
EPSS 0.0029
EPSS Percentile 52.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (3)
org.xwiki.platform/xwiki-platform-tag-api 5.0-milestone-1 - 14.4.8Maven
xwiki/xwiki 5.0 milestone1
xwiki/xwiki 5.0.1 - 14.4.8
Published Jun 23, 2023
Tracked Since Feb 18, 2026