{"id":"CVE-2022-41935","summary":"Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce their existence by repeated Livetable queries. The issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not properly cleaned up of obfuscated entries. As a workaround, The patch for the document `XWiki.LiveTableResultsMacros` can be manually applied or a XAR archive of a patched version can be imported, on versions 12.10.11, 13.9-rc-1, and 13.4.4. There are no known workarounds for this issue.","aliases":["GHSA-p2x4-6ghr-6vmq"],"modified":"2026-08-12T13:33:28.661404Z","published":"2022-11-23T00:00:00Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41935.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19999"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41935.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p2x4-6ghr-6vmq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41935"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"75e8654651969f3f8c27a7747939b1ce1a3a3422"},{"fixed":"f1061cdd99a531c74466c225011a1d25d203a14b"},{"introduced":"0"},{"fixed":"c919088389a89000b2e687f6ae845150c168b967"},{"introduced":"a36ffd8b17ef0eddcbd9a6f3ccc5cf82abb28754"},{"last_affected":"8abb8441e2a4ec27dbf5eb3003984154e6ffc0f0"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:14.4.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.10.11"},{"fixed":"13.10.8"},{"introduced":"14.0.0"},{"fixed":"14.4.3"},{"introduced":"14.4.4"},{"last_affected":"14.4.4"},{"introduced":"14.4.5"},{"last_affected":"14.4.5"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"b72dfa77858847bb8e11b735cf12385520fc2270"},{"fixed":"d24b588df8b5a92bef0214e24d3add8615e6188c"},{"introduced":"0"},{"fixed":"f458acea03f9931f318892b20f4be69f2b743431"},{"introduced":"daf5e736b51daba27b5ddff3bd363dd33bd3cf35"},{"fixed":"1450b6e3c69ac7df25e5a2571186d1f43402facd"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:14.4.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.10.11"},{"fixed":"13.10.8"},{"introduced":"14.0.0"},{"fixed":"14.4.3"},{"introduced":"14.4.4"},{"last_affected":"14.4.4"},{"introduced":"14.4.5"},{"last_affected":"14.4.5"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["14.4.4","14.4.5","xwiki-commons-14.4.5","xwiki-commons-14.4.4","xwiki-commons-14.4.2","xwiki-commons-13.10.7","xwiki-commons-14.4.1","xwiki-commons-13.10.6","xwiki-commons-14.4","xwiki-commons-14.4-rc-1","xwiki-commons-13.10.5","xwiki-commons-13.10.4","xwiki-commons-13.10.3","xwiki-commons-13.10.2","xwiki-commons-13.10.1","xwiki-commons-13.10","xwiki-commons-13.10-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-14.4.2","xwiki-platform-13.10.7","xwiki-platform-14.4.1","xwiki-platform-13.10.6","xwiki-platform-14.4","xwiki-platform-14.4-rc-1","xwiki-platform-13.10.5","xwiki-platform-13.10.4","xwiki-platform-13.10.3","xwiki-platform-13.10.2","xwiki-platform-13.10.1","xwiki-platform-13.10","xwiki-platform-13.10-rc-1","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41935.json","vanir_signatures_modified":"2026-08-12T13:33:28Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd","target":{"file":"xwiki-platform-core/xwiki-platform-livetable/xwiki-platform-livetable-ui/src/test/java/org/xwiki/livetable/LiveTableResultsTest.java"},"deprecated":false,"digest":{"line_hashes":["224495279492900255825043415214618637812","134084062764004029591849910282748179573","80687130255591908977578432065292027416","42708714819221384500046991559299217622","39220636095687237464920006445008808698","245744189568848017656969703867808315277"],"threshold":0.9},"id":"CVE-2022-41935-5a8a9649","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}