CVE-2023-35151

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-35151
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35151.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-35151
Aliases
Published
2023-06-23T16:33:01.388Z
Modified
2026-02-17T00:30:42.199880Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
XWiki Platform may show email addresses in clear in REST results
Details

XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround.

Database specific 
{
    "cwe_ids": [
        "CWE-359"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35151.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
d9d206ca5ef1614a69612c724de47c905f1cebe6
Fixed
b469b950e7fe3d22f00b639d43f286bf871472b1
Database specific 
{
    "versions": [
        {
            "introduced": "7.3-milestone-1"
        },
        {
            "fixed": "14.4.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
ab4dfeaeef13360eebcaa507bc652073aa89a427
Fixed
db1b7950037774552be2897571c2e1c5a7589400
Database specific 
{
    "versions": [
        {
            "introduced": "14.5"
        },
        {
            "fixed": "14.10.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
d823334f762d5ad86bea378b65af0b230668d401
Fixed
b5e50ce3048c00430acd67fe349ebda5f6fe1889
Database specific 
{
    "versions": [
        {
            "introduced": "15.0-rc-1"
        },
        {
            "fixed": "15.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35151.json"