{"id":"CVE-2023-34467","summary":"XWiki Platform may retrieve email addresses of all users ","details":"XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end user was obfuscated, the rest response was also containing the mail unobfuscated and users were able to filter and sort on the unobfuscated, allowing them to infer the mail content. The consequence was the possibility to retrieve the email addresses of all users even when obfuscated. This has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.","aliases":["GHSA-7vr7-cghh-ch63"],"modified":"2026-08-12T13:34:30.662020Z","published":"2023-06-23T16:20:51.164Z","database_specific":{"cwe_ids":["CWE-402"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34467.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20333"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34467.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vr7-cghh-ch63"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34467"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"7aea9643c8c825922890a385dff5f85b8a266dc8"},{"fixed":"48ee3193230753aecf8a86d7c8ff3e8f869e8330"},{"introduced":"719ede2f8510fa69498761659de8d65eec5817db"},{"fixed":"dfd0eff6a9f28f5a8840a5e4a51f0a24524c0280"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:3.5:milestone1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.5.1"},{"fixed":"14.4.8"},{"introduced":"3.5-milestone1"},{"last_affected":"3.5-milestone1"},{"introduced":"14.10"},{"fixed":"14.10.4"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"31024788158cc45879bf15832fa38c4834d434df"},{"fixed":"b469b950e7fe3d22f00b639d43f286bf871472b1"},{"introduced":"c524887d154ff8f6df9651e36b904e234bf5a6ef"},{"fixed":"c127075e7814ef7cd164bb6493d67b1943b6db1e"},{"fixed":"71f889db9962df2d385f4298e29cfbc9050b828a"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:3.5:milestone1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.5.1"},{"fixed":"14.4.8"},{"introduced":"3.5-milestone1"},{"last_affected":"3.5-milestone1"},{"introduced":"14.10"},{"fixed":"14.10.4"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["xwiki-commons-14.10.3","xwiki-commons-14.10.2","xwiki-commons-14.10.1","xwiki-commons-14.10","xwiki-platform-14.10.3","xwiki-platform-14.10.2","xwiki-platform-14.10.1","xwiki-platform-14.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34467.json","vanir_signatures_modified":"2026-08-12T13:34:30Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a","target":{"file":"xwiki-platform-core/xwiki-platform-livetable/xwiki-platform-livetable-ui/src/test/java/org/xwiki/livetable/LiveTableResultsTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"279126616857388280659075024864586023864","length":622},"id":"CVE-2023-34467-75482658","signature_type":"Function"},{"id":"CVE-2023-34467-f3f322f9","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a","target":{"file":"xwiki-platform-core/xwiki-platform-livetable/xwiki-platform-livetable-ui/src/test/java/org/xwiki/livetable/LiveTableResultsTest.java"},"deprecated":false,"digest":{"line_hashes":["85958434038394528563344181650085846055","119443698134936704829936197506736851894","195986345389718146653097988494925620214","156228018702512233019609466763785172818","207016223728304152565403832156489243681","64166451084781420204920652672422608973","18060317440363049015744172958024491659","211604792567352815892144816953881143738","292356532630685653848234560886280081559","302537729189063189521383400244718585078","255856369183180263008615393090111686574","326357899911191184483783808943430385890","237598894387741969837545415830071376666","184300234458401527388769466968718837228","232303136155003374610688648486012515596","157231863617769088759950993722086394321","271410664412614163480744287283930991655","243663400669097626950060075508119217162","232290572477718760965711285158008728109","143537494237598317396799496777431344540","72069955194783011085688697615870061991","317152573112963674360128856142187114728","40682903450549347742860615647988077281","221160894047256464468679255329079944834","309528391990889923836824013559065928299","187564418287891739689572172847470726020","82550142317694520323634852972864942879","262318724901686960766787386782767855416","186654929516560172272067148240207984420","148793903025236294278642128425917321475","198383210088665556684358448729878255457","49805523967496981020248173280041265077","62589850643735185359851194166627124583","136697227880806843254176264226480066782","252221837693794357397905608456034635807","179109335503899873775958487103341909330","112430597737599306390174192159182541242","245744189568848017656969703867808315277"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}