{"id":"CVE-2023-50720","published":"2023-12-15T19:02:35Z","modified":"2024-08-02T22:16:47Z","title":"XWiki Platform Solr search discloses email addresses of users","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":["< 14.10.15",">= 15.0-rc-1, < 15.5.2",">= 15.6-rc-1, < 15.7-rc-1"]}],"description":{"text":"XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.\n","provenance":"source","from":"CVE.org"},"summary":{"text":"XWiki Platform (xwiki-platform) has a flaw in its Solr-based search component that exposes users' email addresses even when email obfuscation is enabled. An attacker with network access can run a regular search such as objcontent:email* through XWiki's search interface to retrieve those addresses, with no authentication or user interaction required and no special configuration beyond the default search setup.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:39Z"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.59119,"percentile":0.99111,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2grh-gr37-2283","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20371","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-search-solr-api","vulnerableRanges":["<14.10.15",">=15.0-rc-1, <15.5.2",">=15.6-rc-1, <15.7-rc-1"],"patched":["14.10.15","15.5.2","15.7-rc-1"],"from":["GHSA-2grh-gr37-2283"],"provenance":"source"}],"advisories":[{"id":"GHSA-2grh-gr37-2283","url":"https://github.com/advisories/GHSA-2grh-gr37-2283","severity":"MODERATE","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-search-solr-api","vulnerableRanges":["<14.10.15"],"patched":["14.10.15"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2grh-gr37-2283","url":"https://github.com/advisories/GHSA-2grh-gr37-2283","severity":"MODERATE","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-search-solr-api","vulnerableRanges":[">=15.0-rc-1, <15.5.2"],"patched":["15.5.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2grh-gr37-2283","url":"https://github.com/advisories/GHSA-2grh-gr37-2283","severity":"MODERATE","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-search-solr-api","vulnerableRanges":[">=15.6-rc-1, <15.7-rc-1"],"patched":["15.7-rc-1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-3073","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-3073","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2023-50720","name":"XWiki < 4.10.15 - Email Disclosure","severity":"medium","path":"http/cves/2023/CVE-2023-50720.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50720.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-12-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-50720","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":28.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9911"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2023-50719","published":"2023-12-15","fixed":"15.7-rc-1","kev":false},{"cve":"CVE-2023-50720","published":"2023-12-15","fixed":"15.7-rc-1","kev":false},{"cve":"CVE-2025-32971","published":"2025-04-30","fixed":"16.8.0-rc-1","kev":false,"link":{"from":"CVE-2023-50720","to":"CVE-2025-32971","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-search-solr-api","fromFixed":"15.7-rc-1","toFixed":"15.10.13","daysApart":502}]}}],"package":"Maven:org.xwiki.platform:xwiki-platform-search-solr-api"}}