Read the docs
TI-2023-11623 Aliases CVE-2023-26476GHSA-5cf8-vrr8-8hjm

Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor

Priority MEDIUM 43CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-307.

Summary

XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02239 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed xwiki-platform (xwiki): 13.4.4, 13.10.9, 14.7-rc-1org.xwiki.platform:xwiki-platform-livetable-ui (Maven): 13.4.4, 13.10.9, 14.7-rc-1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-platform3.2-m3 to before 13.4.4; 13.5.0 to before 13.10.9; 14.0.0 to before 14.7-rc-113.4.4, 13.10.9, 14.7-rc-1Patch availableCNA
—org.xwiki.platform:xwiki-platform-livetable-ui (Maven)3.2-m3 to before 13.4.413.4.4Patch availableGHSA-5cf8-vrr8-8hjm
—org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven)3.2-m3 to before 13.4.413.4.4Patch availableGHSA-5cf8-vrr8-8hjm
—org.xwiki.platform:xwiki-platform-livetable-ui (Maven)13.5.0 to before 13.10.913.10.9Patch availableGHSA-5cf8-vrr8-8hjm
—org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven)13.5.0 to before 13.10.913.10.9Patch availableGHSA-5cf8-vrr8-8hjm
—org.xwiki.platform:xwiki-platform-livetable-ui (Maven)14.0.0 to before 14.7-rc-114.7-rc-1Patch availableGHSA-5cf8-vrr8-8hjm
—org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven)14.0.0 to before 14.7-rc-114.7-rc-1Patch availableGHSA-5cf8-vrr8-8hjm
  • xwiki-platform VendorXWiki Affected 3.2-m3 to before 13.4.4; 13.5.0 to before 13.10.9; 14.0.0 to before 14.7-rc-1 Fixed in 13.4.4, 13.10.9, 14.7-rc-1 Patch available CNA
  • org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Vendor— Affected 3.2-m3 to before 13.4.4 Fixed in 13.4.4 Patch available GHSA-5cf8-vrr8-8hjm
  • org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven) Vendor— Affected 3.2-m3 to before 13.4.4 Fixed in 13.4.4 Patch available GHSA-5cf8-vrr8-8hjm
  • org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Vendor— Affected 13.5.0 to before 13.10.9 Fixed in 13.10.9 Patch available GHSA-5cf8-vrr8-8hjm
  • org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven) Vendor— Affected 13.5.0 to before 13.10.9 Fixed in 13.10.9 Patch available GHSA-5cf8-vrr8-8hjm
  • org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Vendor— Affected 14.0.0 to before 14.7-rc-1 Fixed in 14.7-rc-1 Patch available GHSA-5cf8-vrr8-8hjm
  • org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven) Vendor— Affected 14.0.0 to before 14.7-rc-1 Fixed in 14.7-rc-1 Patch available GHSA-5cf8-vrr8-8hjm

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*3.3 to before 13.4.4; 13.5.0 to before 13.10.9; 14.0 to before 14.7VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:3.2:milestone3:*:*:*:*:*:*3.2 milestone3VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:14.7:rc1:*:*:*:*:*:*14.7 rc1VulnerableXWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions 3.3 to before 13.4.4; 13.5.0 to before 13.10.9; 14.0 to before 14.7 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:3.2:milestone3:*:*:*:*:*:* Versions 3.2 milestone3 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:14.7:rc1:*:*:*:*:*:* Versions 14.7 rc1 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-platform (xwiki) Fixed in 13.4.4, 13.10.9, 14.7-rc-1
  • Fix · GHSA-5cf8-vrr8-8hjm org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Fixed in 13.4.4 Advisory →
  • Fix · GHSA-5cf8-vrr8-8hjm org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven) Fixed in 13.4.4 Advisory →
  • Fix · GHSA-5cf8-vrr8-8hjm org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Fixed in 13.10.9 Advisory →
  • Fix · GHSA-5cf8-vrr8-8hjm org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven) Fixed in 13.10.9 Advisory →
  • Fix · GHSA-5cf8-vrr8-8hjm org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Fixed in 14.7-rc-1 Advisory →
  • Fix · GHSA-5cf8-vrr8-8hjm org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven) Fixed in 14.7-rc-1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26476
  2. 2026-10-03 Alias added: GHSA-5cf8-vrr8-8hjm

References

Exploit 1

Patch 1

Advisory 2

Other 1

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences