Sign in
Deutsch English Español Polski
Low

Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm

  • Disclosed: 12.04.2023
  • Updated: 11.10.2026 13:19

Impact

It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with uorgsuggest.vm. This issue only concerns hidden users from main wiki. Note that the disclosed information are the username and the first and last name of users, no other information is leaked.

Patches

The problem has been patched on XWiki 13.10.8, 14.4.3 and 14.7RC1.

Workarounds

It's possible to workaround this vulnerability by patching directly uorgsuggest.vm to apply the same changes as in https://github.com/xwiki/xwiki-platform/pull/1883.

References

For more information

If you have any questions or comments about this advisory:

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-web-templates >= 13.9-rc-1, < 13.10.8, >= 14.0-rc-1, < 14.4.3, >= 14.5, < 14.7-rc-1 13.10.8, 14.4.3, 14.7-rc-1

References

CVSS score 3.7/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-359, CWE-668
Platform
Java / Kotlin (Maven)
Package
org.xwiki.platform:xwiki-platform-web-templates
Disclosed
12.04.2023
Updated
11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - GHSA-vvp7-r422-rx83 - CC BY 4.0

Vulnerability history: org.xwiki.platform:xwiki-platform-web-templates

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive
Total entries
23
First → latest
02.2022 04.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 10
  • High 4
  • Medium 8
  • Low 1

Disclosures per year

Severity:
  1. In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
    Critical · 9.0 CVE-2024-43401 < 15.10-rc-1 15.10-rc-1
  2. XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
    Critical · 9.0 CVE-2024-41947 >= 11.8-rc-1, < 15.10.8, >= 16.0.0-rc-1, < 16.3.0-rc-1 15.10.8, 16.3.0-rc-1
  3. XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages
    Critical · 9.0 CVE-2023-45137 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  4. XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
    Critical · 9.6 CVE-2023-45136 >= 12.0-rc-1, < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  5. XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
    Critical · 9.0 CVE-2023-45135 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  6. XWiki Platform XSS vulnerability from account in the create page form via template provider
    Critical · 9.0 CVE-2023-45134 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  7. XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
    Critical · 9.6 CVE-2023-35160 >= 2.5-milestone-2, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.10.5, 15.1-rc-1
  8. XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
    Critical · 9.6 CVE-2023-35159 >= 3.4-milestone-1, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.10.5, 15.1-rc-1
  9. XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
    Critical · 9.0 CVE-2023-34464 < 14.4.8, >= 14.5, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.4.8, 14.10.5, 15.1-rc-1
  10. xwiki-platform-web-templates vulnerable to Eval Injection
    Critical · 9.9 CVE-2023-29512 >= 1.0B1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.1 13.10.11, 14.4.8, 14.10.1
  11. Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
    High · 8.9 CVE-2023-29207 >= 1.9-milestone-2, < 13.10.10, >= 14.0-rc-1, < 14.4.6, >= 14.5, < 14.9 13.10.10, 14.4.6, 14.9
  12. Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm this entry
    Low · 3.7 CVE-2023-29203 >= 13.9-rc-1, < 13.10.8, >= 14.0-rc-1, < 14.4.3, >= 14.5, < 14.7-rc-1 13.10.8, 14.4.3, 14.7-rc-1
  13. XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor
    High · 7.5 CVE-2022-36091 >= 1.3, < 13.10.4 13.10.4
  14. XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
    High · 8.5 CVE-2022-36093 < 13.10.5, >= 14.0, < 14.3-rc-1 13.10.5, 14.3-rc-1
  15. Cross site scripting in registration template in xwiki-platform
    High · 7.4 CVE-2022-23622 >= 2.6.1, < 12.10.11, >= 13.0.0, < 13.4.7, >= 13.10.0, < 13.10.3 12.10.11, 13.4.7, 13.10.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.