CVE-2023-35151

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-35151
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35151.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-35151
Aliases
Published
2023-06-23T16:33:01.388Z
Modified
2026-07-15T02:08:45.825357149Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
XWiki Platform may show email addresses in clear in REST results
Details

XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35151.json",
    "cwe_ids": [
        "CWE-359"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
2f0c8392502d6020ed990893e9a0917d0bfcf904
Fixed
48ee3193230753aecf8a86d7c8ff3e8f869e8330
Introduced
719ede2f8510fa69498761659de8d65eec5817db
Fixed
f0645cf53274e7ef6c17285a079673573c4e41c2
Introduced
05fc0ee1dddc3de20c97cc407b721b0d3d919d99
Last affected
fdba4ca1398766e912f7888af5bdefbeef60d8b0
Database specific 
{
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:7.3:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "7.4"
        },
        {
            "fixed": "14.4.8"
        },
        {
            "introduced": "14.10"
        },
        {
            "fixed": "14.10.6"
        },
        {
            "introduced": "7.3-milestone1"
        },
        {
            "last_affected": "7.3-milestone1"
        },
        {
            "introduced": "15.0"
        },
        {
            "last_affected": "15.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
298e0f7ece5eb04a4a090e021a639bc9cc1b97e9
Fixed
b469b950e7fe3d22f00b639d43f286bf871472b1
Introduced
c524887d154ff8f6df9651e36b904e234bf5a6ef
Fixed
db1b7950037774552be2897571c2e1c5a7589400
Introduced
d9d206ca5ef1614a69612c724de47c905f1cebe6
Fixed
824cd742ecf5439971247da11bfe7e0ad2b10ede
Database specific 
{
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:7.3:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "7.4"
        },
        {
            "fixed": "14.4.8"
        },
        {
            "introduced": "14.10"
        },
        {
            "fixed": "14.10.6"
        },
        {
            "introduced": "7.3-milestone1"
        },
        {
            "last_affected": "7.3-milestone1"
        },
        {
            "introduced": "15.0"
        },
        {
            "last_affected": "15.0"
        }
    ]
}

Affected versions

15.*
15.0
7.*
7.3-milestone1
xwiki-commons-14.*
xwiki-commons-14.10
xwiki-commons-14.10.1
xwiki-commons-14.10.2
xwiki-commons-14.10.3
xwiki-commons-14.10.4
xwiki-commons-14.10.5
xwiki-platform-14.*
xwiki-platform-14.10
xwiki-platform-14.10.1
xwiki-platform-14.10.2
xwiki-platform-14.10.3
xwiki-platform-14.10.4
xwiki-platform-14.10.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35151.json"