CVE-2023-50719CWE-200CWE-359

XWiki Platform Solr search discloses password hashes of all users

High · published December 15, 2023

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.7th percentile for exploit probability.

CVSS v3.1
7.5
EPSS
84%
Percentile
99.7
In the wild
Unconfirmed
What it is

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text. This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.83548 · 99.7th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2023-12-15T19:02Z
EPSS history
Timeline
  • 15 DEC 19:02Z
    XWiki Platform Solr search discloses password hashes of all users
    cvelistv5