Insufficiently protected credentials in XWiki platform - CVE-2023-34465
Published: June 20, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU129947
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-34465
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and modify mail configuration.
The vulnerability exists due to improper access control in Mail.MailConfig when handling edit requests. A remote user can edit the page to view and modify the mail sending configuration, including the SMTP domain name and credentials, to disclose sensitive information and modify mail configuration.
By default, any logged-in user with edit rights can exploit this issue.
Affected software
XWiki platform
How to mitigate CVE-2023-34465
Install security update from vendor's website.
XWiki platform - addressed in versions 14.4.8, 14.10.6, 15.1