Patchfirst
Patchfirst
CVE-2023-50720 Public exploit Medium · 5.3 EPSS 59.1%

XWiki Platform Solr search discloses email addresses of users

xwiki · xwiki-platform

Summary

XWiki Platform (xwiki-platform) has a flaw in its Solr-based search component that exposes users' email addresses even when email obfuscation is enabled. An attacker with network access can run a regular search such as objcontent:email* through XWiki's search interface to retrieve those addresses, with no authentication or user interaction required and no special configuration beyond the default search setup.

Official description · CVE.org

XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.

Breakdown
28.5 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 15 Dec 2023. No public exploit code or confirmed exploitation is recorded.

3 fixes in xwiki-platform-search-solr-api over 17 months. The latest fix listed for xwiki-platform-search-solr-api is 16.8.0-rc-1.

Fixes in xwiki-platform-search-solr-apiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 15.7-rc-1CVE-2023-5071915 Dec 2023
  2. 15.7-rc-1CVE-2023-5072015 Dec 2023
  3. 16.8.0-rc-1CVE-2025-3297130 Apr 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-search-solr-api.

Mavenorg.xwiki.platform:xwiki-platform-search-solr-apiGHSA-2grh-gr37-2283

Upgrade to 15.5.2

Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-50719).

Also affected, despite being newer: 15.6-rc-1 up to 15.7-rc-1.

Set the version to 15.5.2 or later in your pom.xml or build.gradle.

The first fix for CVE-2023-50720.

Affected versions, by release line

If you runUpgrade to
15.6-rc-1 up to 15.7-rc-115.7-rc-1
15.0-rc-1 up to 15.5.215.5.2
All versions before 14.10.1514.10.15

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-2grh-gr37-2283

x_refsource_MISC 2

github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eeajira.xwiki.org/browse/XWIKI-20371
↑ ↓ chooseEnter openEsc close