Read the docs
TI-2026-35490 Aliases CVE-2026-48048GHSA-rh28-mqj4-8x59

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

Priority MEDIUM 43CWE-359Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-359.

Summary

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02008 80th percentileScored 2026-11-07
Fix Fixed xwiki-platform (xwiki): 16.10.17, 17.4.9, 17.10.3org.xwiki.platform:xwiki-platform-livetable-ui (Maven): 16.10.17, 17.4.9, 17.10.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-platform6.2.1 to before 16.10.17; 17.0.0-rc-1 to before 17.4.9; 17.5.0-rc-1 to before 17.10.316.10.17, 17.4.9, 17.10.3Patch availableCNA
—org.xwiki.platform:xwiki-platform-livetable-ui (Maven)6.2.1 to before 16.10.1716.10.17Patch availableGHSA-rh28-mqj4-8x59
—org.xwiki.platform:xwiki-platform-livetable-ui (Maven)17.0.0-rc-1 to before 17.4.917.4.9Patch availableGHSA-rh28-mqj4-8x59
—org.xwiki.platform:xwiki-platform-livetable-ui (Maven)17.5.0-rc-1 to before 17.10.317.10.3Patch availableGHSA-rh28-mqj4-8x59
  • xwiki-platform VendorXWiki Affected 6.2.1 to before 16.10.17; 17.0.0-rc-1 to before 17.4.9; 17.5.0-rc-1 to before 17.10.3 Fixed in 16.10.17, 17.4.9, 17.10.3 Patch available CNA
  • org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Vendor— Affected 6.2.1 to before 16.10.17 Fixed in 16.10.17 Patch available GHSA-rh28-mqj4-8x59
  • org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Vendor— Affected 17.0.0-rc-1 to before 17.4.9 Fixed in 17.4.9 Patch available GHSA-rh28-mqj4-8x59
  • org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Vendor— Affected 17.5.0-rc-1 to before 17.10.3 Fixed in 17.10.3 Patch available GHSA-rh28-mqj4-8x59

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*——XWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions — — ·XWiki

Remediation

  • Fix · CNA xwiki-platform (xwiki) Fixed in 16.10.17, 17.4.9, 17.10.3
  • Fix · GHSA-rh28-mqj4-8x59 org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Fixed in 16.10.17 Advisory →
  • Fix · GHSA-rh28-mqj4-8x59 org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Fixed in 17.4.9 Advisory →
  • Fix · GHSA-rh28-mqj4-8x59 org.xwiki.platform:xwiki-platform-livetable-ui (Maven) Fixed in 17.10.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48048
  2. 2026-10-03 Alias added: GHSA-rh28-mqj4-8x59
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Other 4

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 304 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences