U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.


Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Vulnerability Change Records for CVE-2023-50719

Change History

New CVE Received by NIST 12/15/2023 2:15:09 PM

Action Type Old Value New Value
Added CVSS V3.1

GitHub, Inc. AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Added CWE

GitHub, Inc. CWE-200
Added CWE

GitHub, Inc. CWE-359
Added Description

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text.  This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability.
Added Reference

GitHub, Inc. https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea [No types assigned]
Added Reference

GitHub, Inc. https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p6cp-6r35-32mh [No types assigned]
Added Reference

GitHub, Inc. https://jira.xwiki.org/browse/XWIKI-21208 [No types assigned]