Vulnerability Details : CVE-2023-34465

XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and view and edit the mail sending configuration, including the smtp domain name and credentials. The problem has been patched in XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, the rights of the `Mail.MailConfig` page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the `XWiki.XWikiAdminGroup` group).
Published 2023-06-23 16:15:09
Updated 2023-06-30 13:14:06
Source GitHub, Inc.
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-34465

EPSS FAQ
0.11%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 44 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-34465

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
8.1
 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
2.8
5.2
 NIST
9.9
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
3.1
6.0
 GitHub, Inc.

CWE ids for CVE-2023-34465

  • The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
    Assigned by: security-advisories@github.com (Primary)

References for CVE-2023-34465

Products affected by CVE-2023-34465

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close