What is GHSA-5cf8-vrr8-8hjm?

GHSA-5cf8-vrr8-8hjm is a security advisory published by GitHub Security Advisories with High severity. XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor

Which CVE IDs does GHSA-5cf8-vrr8-8hjm cover?

GHSA-5cf8-vrr8-8hjm covers the following CVE IDs: CVE-2023-26476. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5cf8-vrr8-8hjm?

GHSA-5cf8-vrr8-8hjm has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-5cf8-vrr8-8hjm?

GHSA-5cf8-vrr8-8hjm affects 6 products, including: maven/org.xwiki.platform:xwiki-platform-livetable-ui:\u003e= 3.2-m3, \u003c 13.4.4; maven/org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki:\u003e= 3.2-m3, \u003c 13.4.4; maven/org.xwiki.platform:xwiki-platform-livetable-ui:\u003e= 13.5.0, \u003c 13.10.9; maven/org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki:\u003e= 13.5.0, \u003c 13.10.9; maven/org.xwiki.platform:xwiki-platform-livetable-ui:\u003e= 14.0.0, \u003c 14.7-rc-1; and others — see the full list on the advisory page.

GHSA-5cf8-vrr8-8hjmHighCVSS 7.5

XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor

Vendor

GitHub Security Advisories

Published

March 3, 2023

Last Modified

March 14, 2023

🔗 CVE IDs covered (1)

CVE-2023-26476 →

📋 Description

Impact

Users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros.

Patches

The issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9.

Workarounds

The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, and 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on LiveTableResults and WikisLiveTableResultsMacros.

References

Jira: https://jira.xwiki.org/browse/XWIKI-19949
Patch: https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

🎯 Affected products6

maven/org.xwiki.platform:xwiki-platform-livetable-ui:>= 3.2-m3, < 13.4.4
maven/org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki:>= 3.2-m3, < 13.4.4
maven/org.xwiki.platform:xwiki-platform-livetable-ui:>= 13.5.0, < 13.10.9
maven/org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki:>= 13.5.0, < 13.10.9
maven/org.xwiki.platform:xwiki-platform-livetable-ui:>= 14.0.0, < 14.7-rc-1
maven/org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki:>= 14.0.0, < 14.7-rc-1