CVE-2023-34465

Katalog CVE

CVSS 8.1 · High EPSS 0,85%

Kerentanan Improper Privilege Management pada xwiki. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and view and edit the mail sending configuration, including the smtp domain name and credentials. The problem has been patched in XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, the rights of the `Mail.MailConfig` page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the `XWiki.XWikiAdminGroup` group).

Rincian

Terbit di NVD

23 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 57,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1 patch · advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4 patch · advisory vendor
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g75c-cjr6-39mc advisory vendor
• https://jira.xwiki.org/browse/XWIKI-20519 issue tracking · patch · advisory vendor
• https://jira.xwiki.org/browse/XWIKI-20671 exploit · issue tracking · patch · advisory vendor