CVE-2023-35151: Exposure of Resource to Wrong Sphere

June 20, 2023 (updated June 30, 2023)

XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround.

References

github.com/advisories/GHSA-8g9c-c9cm-9c56
github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10ede
github.com/xwiki/xwiki-platform/security/advisories/GHSA-8g9c-c9cm-9c56
jira.xwiki.org/browse/XWIKI-16138
nvd.nist.gov/vuln/detail/CVE-2023-35151

Detect and mitigate CVE-2023-35151 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →