CVE-2023-50720: fallo de gravedad media en xwiki-platform
XWiki Platform Solr search discloses email addresses of users
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear xwiki-platform+ Monitorear org.xwiki.platform:xwiki-platform-search-solr-api
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
40Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 5.3epss 59%
XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
xwiki · xwiki-platformCVEs relacionadas — xwiki-platform
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-24893CRITICALRemote code execution as guest via SolrSearchMacros request in xwikiEPSS 100.0%KEVCVE-2024-21650CRITICALXWiki Remote Code Execution vulnerability via user registrationEPSS 93.5%CVE-2023-37462CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiEPSS 91.6%CVE-2023-46731CRITICALRemote code execution through the section parameter in Administration as guest in XWiki PlatformEPSS 89.7%CVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 85.5%CVE-2023-50719HIGHXWiki Platform Solr search discloses password hashes of all usersEPSS 83.5%