CVE-2023-35151

HIGH

Xwiki < 14.4.8 - Exposure to Wrong Actor

Title source: rule

Description

XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround.

References (3)

Scores

CVSS v3 7.5
EPSS 0.0027
EPSS Percentile 50.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE
CWE-359 CWE-668
Status published

Affected Products (5)

xwiki/xwiki < 14.4.8
xwiki/xwiki
xwiki/xwiki
xwiki/xwiki
org.xwiki.platform/xwiki-platform-rest-server < 14.4.8Maven

Timeline

Published Jun 23, 2023
Tracked Since Feb 18, 2026