What’s Vulnerable › Vulnerabilities

CVE-2023-50720: XWiki Platform Solr search discloses email addresses of users

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 59.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-12-15 · updated 2026-06-17
• Weakness: CWE-200

Description

XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.

Affected products

• xwiki-platform: before 14.10.5; from 15.0 before 15.5.2; 15.6, 15.6-rc1, 15.7-rc1 — fixed in 14.10.5, 15.5.2

How to fix

Upgrade to a fixed version: xwiki-platform 14.10.5, 15.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2grh-gr37-2283
• https://jira.xwiki.org/browse/XWIKI-20371
• https://github.com/xwiki/xwiki-platform/commit/3e5272f2ef0dff06a8f4db10afd1949b2f9e6eea
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2grh-gr37-2283
• https://jira.xwiki.org/browse/XWIKI-20371

Get alerted when CVE-2023-50720 or the next vulnerability affects your stack