CVE-2023-26476

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-26476

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26476.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-26476

Aliases

GHSA-5cf8-vrr8-8hjm

Published

2023-03-02T18:02:20.328Z

Modified

2026-08-12T14:50:38.254667Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor

Details

XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on LiveTableResults and WikisLiveTableResultsMacros.

Database specific

{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26476.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type

GIT

Repo

https://github.com/xwiki/xwiki-commons

Events

Introduced

09af15d4432bf2c8262f37542a0a7ffdbb719aea

Fixed

48e84afcd78dddb228a53067132edcaace7c65d2

Introduced

Fixed

04c07ad2e0614b2e5cead6d60477e5954e3e0278

Introduced

491547c4f74b9be58123ef22081ae7e6840a11c7

Fixed

1194236d6104ade6659cd887e1bb9f3c10821e26

Introduced

debbc2712f681f1f0ce1f0ba4ed295d37813b596

Last affected

debbc2712f681f1f0ce1f0ba4ed295d37813b596

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:3.2:milestone3:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.3"
        },
        {
            "fixed": "13.4.4"
        },
        {
            "introduced": "13.5.0"
        },
        {
            "fixed": "13.10.9"
        },
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.7"
        },
        {
            "introduced": "3.2-milestone3"
        },
        {
            "last_affected": "3.2-milestone3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Type

GIT

Repo

https://github.com/xwiki/xwiki-platform

Events

Introduced

5af482676d6b9b3c06a440ad4918cdf715bf8542

Fixed

ac12f8e2f29d301d4dcd677381c24b864fa1544b

Introduced

Fixed

fa7b28faa2fe1863c39b02cdf029381c8f5a4b4c

Introduced

d971304b0e0bf4f6dad278de89518edc17459741

Fixed

3238ef965525b6aea7e3d912b5a1885aa985b222

Introduced

817e71d7c385e25600f16c5ed7245eaa20fee43a

Fixed

7f8825537c9523ccb5051abd78014d156f9791c8

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:3.2:milestone3:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.3"
        },
        {
            "fixed": "13.4.4"
        },
        {
            "introduced": "13.5.0"
        },
        {
            "fixed": "13.10.9"
        },
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.7"
        },
        {
            "introduced": "3.2-milestone3"
        },
        {
            "last_affected": "3.2-milestone3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

3.*

3.2-milestone3

xwiki-commons-13.*

xwiki-commons-13.10

xwiki-commons-13.10-rc-1

xwiki-commons-13.10.1

xwiki-commons-13.10.2

xwiki-commons-13.10.3

xwiki-commons-13.10.4

xwiki-commons-13.10.5

xwiki-commons-13.10.6

xwiki-commons-13.10.7

xwiki-commons-13.10.8

xwiki-commons-13.4

xwiki-commons-13.4-rc-1

xwiki-commons-13.4.1

xwiki-commons-13.4.2

xwiki-commons-13.4.3

xwiki-commons-14.*

xwiki-commons-14.7-rc-1

xwiki-commons-3.*

xwiki-commons-3.2-milestone-3

xwiki-commons-8.*

xwiki-commons-8.0-milestone-1

xwiki-commons-8.0-milestone-2

xwiki-commons-8.1-milestone-1

xwiki-commons-8.1-milestone-2

xwiki-commons-8.2-milestone-1

xwiki-commons-8.2-milestone-2

xwiki-commons-8.3-milestone-1

xwiki-commons-8.3-milestone-2

xwiki-platform-13.*

xwiki-platform-13.10

xwiki-platform-13.10-rc-1

xwiki-platform-13.10.1

xwiki-platform-13.10.2

xwiki-platform-13.10.3

xwiki-platform-13.10.4

xwiki-platform-13.10.5

xwiki-platform-13.10.6

xwiki-platform-13.10.7

xwiki-platform-13.4

xwiki-platform-13.4-rc-1

xwiki-platform-13.4.1

xwiki-platform-13.4.2

xwiki-platform-13.4.3

xwiki-platform-14.*

xwiki-platform-14.7-rc-1

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2

xwiki-platform-7.4-milestone-1

xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1

xwiki-platform-8.0-milestone-2

xwiki-platform-8.1-milestone-1

xwiki-platform-8.1-milestone-2

xwiki-platform-8.2-milestone-1

xwiki-platform-8.2-milestone-2

xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

Database specific

vanir_signatures_modified

"2026-08-12T14:50:38Z"

vanir_signatures

[
    {
        "id": "CVE-2023-26476-ff319067",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "89682815596848995582458015367900842712",
                "32805766459744904004856476091149137130",
                "232303136155003374610688648486012515596",
                "60753946066203983384981238966024109027",
                "198752432658054770709346246597400837929",
                "140764397076062067713823077114380169967",
                "53298633393457966238331907775288049311",
                "205019071073179689961786149771938169102",
                "245744189568848017656969703867808315277"
            ]
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livetable/xwiki-platform-livetable-ui/src/test/java/org/xwiki/livetable/LiveTableResultsTest.java"
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26476.json"