{"id":"GHSA-8g9c-c9cm-9c56","summary":"XWiki Platform may show email addresses in clear in REST results","details":"### Impact\nAny user can call a REST endpoint and obtain the obfuscated passwords (even when the mail obfuscation is activated).\n\nFor instance, by calling http://localhost:8080/xwiki/rest/wikis/xwiki/spaces/XWiki/pages/U1/objects/XWiki.XWikiUsers/0 when user `U1` exists on wiki `xwiki`.\n\n### Patches\nThe issue has been patched on XWiki 14.4.8, 14.10.6, and 15.1 \n\n### Workarounds\nThere is no known workaround. It is advised to upgrade to one of the patched versions.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-16138\n- https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10ede\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n","aliases":["CVE-2023-35151"],"modified":"2023-11-08T04:12:50.256108Z","published":"2023-06-20T16:46:29Z","database_specific":{"nvd_published_at":"2023-06-23T17:15:09Z","cwe_ids":["CWE-359","CWE-668"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-06-20T16:46:29Z"},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8g9c-c9cm-9c56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35151"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10ede"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-16138"}],"affected":[{"package":{"name":"org.xwiki.platform:xwiki-platform-rest-server","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-rest-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3-milestone-1"},{"fixed":"14.4.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-8g9c-c9cm-9c56/GHSA-8g9c-c9cm-9c56.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-rest-server","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-rest-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.10.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-8g9c-c9cm-9c56/GHSA-8g9c-c9cm-9c56.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-rest-server","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-rest-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0-rc-1"},{"fixed":"15.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-8g9c-c9cm-9c56/GHSA-8g9c-c9cm-9c56.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}