CVE-2023-50719 Public exploit High · 7.5 EPSS 83.5%

XWiki Platform Solr search discloses password hashes of all users

xwiki · xwiki-platform

Summary

The XWiki Platform (xwiki-platform) has a flaw in its Solr-based search component that exposes users' password hashes and, for extensions storing secrets such as API keys in their configuration, those values as plain text. An unauthenticated remote attacker with view rights on user profiles (which are public by default) can obtain these via search, with no user interaction required.

Official description · CVE.org

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text. This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability.

Breakdown

30.2 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Disclosed on 15 Dec 2023. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-search-solr-api.

Mavenorg.xwiki.platform:xwiki-platform-search-solr-apiGHSA-p6cp-6r35-32mh

Upgrade to 15.5.2

Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-50720).

Also affected, despite being newer: 15.6-rc-1 up to 15.7-rc-1.

Set the version to 15.5.2 or later in your pom.xml or build.gradle.

The first fix for CVE-2023-50719.

Affected versions, by release line

If you run	Upgrade to
15.6-rc-1 up to 15.7-rc-1	15.7-rc-1
15.0-rc-1 up to 15.5.2	15.5.2
7.2-milestone-2 up to 14.10.15	14.10.15

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-p6cp-6r35-32mh

x_refsource_MISC 2

github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea jira.xwiki.org/browse/XWIKI-21208

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2023-3256

Public exploitAdvisories link exploit code.

, 31 Oct 2026

83.5%Top 0.31%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.69%).

3.1

7.5High · 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9969 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 nuclei template 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 7.5 5.3/7

End-of-life productsupported or unknown 0.0

Total30.2

Record

Published: 15 Dec 2023
Modified: 8 Oct 2024
: CWE-359 Exposure of Private Personal Information to an Unauthorized ActorCWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Elsewhere: NVD CVE.org JSON