{"id":"CVE-2023-26476","aliases":["EUVD-2023-0882","GHSA-5cf8-vrr8-8hjm"],"status":"published","title":"Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor","description":"XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version \u003e= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02239,"percentile":0.83055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-307"],"published":"2023-03-02T18:02:20Z","modified":"2026-10-28T10:38:33Z","fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-livetable-ui","fixed_in":["13.4.4","13.10.9","14.7-rc-1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","fixed_in":["13.4.4","13.10.9","14.7-rc-1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-livetable-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2-m3"},{"fixed":"13.4.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2-m3"},{"fixed":"13.4.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-livetable-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.0"},{"fixed":"13.10.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.0"},{"fixed":"13.10.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-livetable-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.7-rc-1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.7-rc-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-livetable-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2-m3"},{"fixed":"13.4.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2-m3"},{"fixed":"13.4.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-livetable-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.0"},{"fixed":"13.10.9"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.0"},{"fixed":"13.10.9"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-livetable-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.7-rc-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.7-rc-1"}]}]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5cf8-vrr8-8hjm","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-19949","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26476","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5cf8-vrr8-8hjm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26476.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-26476","title":"Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor","description":"XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version \u003e= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.","status":"published","published":"2023-03-02T18:02:20.328Z","modified":"2025-03-05T21:24:50.665Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-0882","description":"XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version \u003e= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.","status":"published","published":"2023-03-02T18:02:20Z","modified":"2025-03-05T21:24:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:11.987115Z"}],"ghsa":[{"id":"GHSA-5cf8-vrr8-8hjm","title":"XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor","description":"### Impact\nUsers can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`.\n\n### Patches\nThe issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9.\n\n### Workarounds\nThe issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, and 13.10.9 and higher, or in version \u003e= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.\n\n### References\n- Jira: https://jira.xwiki.org/browse/XWIKI-19949\n- Patch: https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)\n","status":"published","published":"2023-03-03T22:47:49Z","modified":"2023-03-14T19:39:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-307"],"updated_at":"2026-11-02T14:36:48.041653Z"}],"nvd":[{"id":"CVE-2023-26476","description":"XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version \u003e= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.","status":"published","published":"2023-03-02T19:15:11.567Z","modified":"2026-06-17T05:43:25.103Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200","CWE-307"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"CVE-2023-26476","title":"Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor","description":"XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version \u003e= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.","status":"published","published":"2023-03-02T18:02:20.328Z","modified":"2026-10-28T10:38:33.947506193Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"GHSA-5cf8-vrr8-8hjm","title":"XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor","description":"### Impact\nUsers can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`.\n\n### Patches\nThe issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9.\n\n### Workarounds\nThe issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, and 13.10.9 and higher, or in version \u003e= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.\n\n### References\n- Jira: https://jira.xwiki.org/browse/XWIKI-19949\n- Patch: https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)\n","status":"published","published":"2023-03-03T22:47:49Z","modified":"2026-09-10T03:49:52.895435249Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-307"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}