Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2023-29203

LOW
Published 2023-04-15T15:17:46.895Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2023-29203. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
3.7
/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.001
probability
of exploitation in the wild

There is a 0.1% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.318
Higher than 31.8% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED

Impact Metrics

Confidentiality
LOW
Integrity
NONE
Availability
NONE

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with `uorgsuggest.vm`. This issue only concerns hidden users from main wiki. Note that the disclosed information are the username and the first and last name of users, no other information is leaked. The problem has been patched on XWiki 13.10.8, 14.4.3 and 14.7RC1.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

xwiki

xwiki-platform

Affected Versions:

>= 13.9-rc-1, < 13.10.8 >= 14.0-rc-1, < 14.4.3 >= 14.5, < 14.7-rc-1

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed LOW

Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm

GHSA-vvp7-r422-rx83

Advisory Details

### Impact It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with `uorgsuggest.vm`. This issue only concerns hidden users from main wiki. Note that the disclosed information are the username and the first and last name of users, no other information is leaked. ### Patches The problem has been patched on XWiki 13.10.8, 14.4.3 and 14.7RC1. ### Workarounds It's possible to workaround this vulnerability by patching directly `uorgsuggest.vm ` to apply the same changes as in https://github.com/xwiki/xwiki-platform/pull/1883. ### References * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-20007 * this vulnerability is actually a remaining of https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-97jg-43c9-q6pf which wasn't entirely fixed back then ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira](https://jira.xwiki.org) * Email us at [security ML](mailto:[email protected])

Affected Packages

Maven org.xwiki.platform:xwiki-platform-web-templates
ECOSYSTEM: ≥13.9-rc-1 <13.10.8
Maven org.xwiki.platform:xwiki-platform-web-templates
ECOSYSTEM: ≥14.0-rc-1 <14.4.3
Maven org.xwiki.platform:xwiki-platform-web-templates
ECOSYSTEM: ≥14.5 <14.7-rc-1

CVSS Scoring

CVSS Score

2.5

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

WEB https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-97jg-43c9-q6pf
WEB https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vvp7-r422-rx83
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-29203
WEB https://github.com/xwiki/xwiki-platform/pull/1883
PACKAGE https://github.com/xwiki/xwiki-platform
WEB https://jira.xwiki.org/browse/XWIKI-20007

Advisory provided by GitHub Security Advisory Database. Published: April 12, 2023, Modified: April 16, 2023

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vvp7-r422-rx83
https://github.com/xwiki/xwiki-platform/pull/1883
https://jira.xwiki.org/browse/XWIKI-20007
Published: 2023-04-15T15:17:46.895Z
Last Modified: 2025-02-06T19:10:15.998Z
Copied to clipboard!