CVE-2023-35151: xwiki — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2023-35151

CVSS 7.5 · High EPSS 0,72%

Kerentanan Exposure of Private Personal Information to an Unauthorized Actor pada xwiki. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround.

Rincian

Terbit di NVD: 23 Juni 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
CWE-668: Exposure of Resource to Wrong Sphere
EPSS (30 hari): 0,72% peluang dieksploitasi; lebih tinggi dari 52,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xwiki	xwiki	Versi 7.4 hingga sebelum 14.4.8
xwiki	xwiki	Versi 14.10 hingga sebelum 14.10.6
xwiki	xwiki	Versi 7.3 milestone1
xwiki	xwiki	Versi 15.0
xwiki	xwiki	Versi 15.0 rc1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10ede patch · advisory vendor
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8g9c-c9cm-9c56 advisory vendor
https://jira.xwiki.org/browse/XWIKI-16138 issue tracking · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.