https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 07:18:42 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-05279 bdu:2023-05279 https://cve.radiocsirt.org/vuln/bdu:2023-05279 https://cve.radiocsirt.org/vuln/euvd-2026-204978 EUVD-2026-204978 https://cve.radiocsirt.org/vuln/euvd-2026-204978 https://cve.radiocsirt.org/vuln/fkie_cve-2023-34467 <p>XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end user was obfuscated, the rest response was also containing the mail unobfuscated and users were able to filter and sort on the unobfuscated, allowing them to infer the mail content. The consequence was the possibility to retrieve the email addresses of all users even when obfuscated. This has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.</p> <p>XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end user was obfuscated, the rest response was also containing the mail unobfuscated and users were able to filter and sort on the unobfuscated, allowing them to infer the mail content. The consequence was the possibility to retrieve the email addresses of all users even when obfuscated. This has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-34467 https://cve.radiocsirt.org/vuln/ghsa-7vr7-cghh-ch63 <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-livetable-ui</p> <p>### Impact The mail obfuscation configuration was not fully taken into account and while the mail displayed to the end user was obfuscated: - the rest response was also containing the mail unobfuscated - user were able to filter and sort on the unobfuscated (allowing to infer the mail content)</p> <p>The consequence was the possibility to retrieve the email addresses of all users even when obfuscated.</p> <p>See https://jira.xwiki.org/browse/XWIKI-20333 for the reproduction steps.</p> <p>### Patches This has been patched in XWiki 14.10.4, XWiki 14.4.8, and XWiki 15.0-rc-1.</p> <p>### Workarounds The workaround is to modify the page `XWiki.LiveTableResultsMacros` following this [patch](https://github.com/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a).</p> <p>### References</p> <p>https://jira.xwiki.org/browse/XWIKI-20333</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)</p> <p>### Attribution</p> <p>This vulnerability has been reported on Intigriti by @floerer</p> <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-livetable-ui</p> <p>### Impact The mail obfuscation configuration was not fully taken into account and while the mail displayed to the end user was obfuscated: - the rest response was also containing the mail unobfuscated - user were able to filter and sort on the unobfuscated (allowing to infer the mail content)</p> <p>The consequence was the possibility to retrieve the email addresses of all users even when obfuscated.</p> <p>See https://jira.xwiki.org/browse/XWIKI-20333 for the reproduction steps.</p> <p>### Patches This has been patched in XWiki 14.10.4, XWiki 14.4.8, and XWiki 15.0-rc-1.</p> <p>### Workarounds The workaround is to modify the page `XWiki.LiveTableResultsMacros` following this [patch](https://github.com/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a).</p> <p>### References</p> <p>https://jira.xwiki.org/browse/XWIKI-20333</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)</p> <p>### Attribution</p> <p>This vulnerability has been reported on Intigriti by @floerer</p> https://cve.radiocsirt.org/vuln/ghsa-7vr7-cghh-ch63 https://cve.radiocsirt.org/vuln/gsd-2023-34467 gsd-2023-34467 https://cve.radiocsirt.org/vuln/gsd-2023-34467