CVE-2023-34466 MEDIUM

CVE-2023-34466: XWiki Platform's tags on non-viewable pages can be revealed to users

Vendor Xwiki
Product xwiki-platform
Weakness CWE-200 · Info exposure
Published June 23, 2023
Last update November 29, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.

Key dates

02Disclosure timeline

June 23, 2023 CVE published
November 29, 2024 Record updated