CVE-2023-50720

mediumPriorität · verfolgen · 42EPSS 0.591 · 99. PerzentilEURUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

59.1% (99th) EPSS

CVSS 5.3 · medium

Is it mine?

15 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · bewertet 2026-10-27

XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 1.4

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 3.9 · Auswirkung 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · OSV

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Hsecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-200USCWE-200USCWE-200US

betroffene Produkte (15)

Betroffene Produkte und Versionsbereiche.

xwiki xwiki-platform≤ < 14.10.15enisa_euvdEU
xwiki xwiki-platform15.0-rc-1, → 15.5.2enisa_euvdEU
xwiki xwiki-platform15.6-rc-1, → 15.7-rc-1enisa_euvdEU
Сообщество свободного программного обеспечения XWiki Platform≤ 15.7fstec_bduRU
Сообщество свободного программного обеспечения XWiki Platform≤ 14.10.5fstec_bduRU
Сообщество свободного программного обеспечения XWiki Platform≤ 15.6 rc1fstec_bduRU
Сообщество свободного программного обеспечения XWiki Platform≤ 15.6fstec_bduRU
Сообщество свободного программного обеспечения XWiki Platform15.0 → 15.5.2fstec_bduRU
xwiki xwiki< 14.10.5nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki15.0 → 15.5.2nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki= 15.6nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki= 15.7nvdUScpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Maven org.xwiki.platform:xwiki-platform-search-solr-api< 14.10.15osvUSpkg:maven/org.xwiki.platform/xwiki-platform-search-solr-api
Maven org.xwiki.platform:xwiki-platform-search-solr-api15.0-rc-1 → 15.5.2osvUSpkg:maven/org.xwiki.platform/xwiki-platform-search-solr-api
Maven org.xwiki.platform:xwiki-platform-search-solr-api15.6-rc-1 → 15.7-rc-1osvUSpkg:maven/org.xwiki.platform/xwiki-platform-search-solr-api

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-2grh-gr37-2283Solr search discloses email addresses of users2023-12-16ghsa · osvUS
### Impact The Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. ### Patches This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. Further, changing the setting now triggers re-indexing of the affected wiki(s). ### Workarounds We're not aware of any workarounds. ### References * https://jira.xwiki.org/browse/XWIKI-20371 * https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea ### Attribution This vulnerability was reported on Intigriti by [ynoof](https://twitter.com/ynoofAssiri) @Ynoof5.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

veröffentlicht 2023-12-15geändert 2026-06-17

Referenzen (10)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan