CVE-2023-34465
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In XWiki Platform, from version 11.8-rc-1 to 14.4.8, 14.10.6, and 15.2, any logged-in user can edit the `Mail.MailConfig` configuration. This allows them to change the mail obfuscation settings and view and edit mail sending configurations, including the SMTP domain name and credentials.
Risk Assessment
The organization may be exposed to unauthorized changes in mail configuration, potentially leading to data leaks or unauthorized access to email accounts.
Recommendation
It is recommended to upgrade to XWiki versions 14.4.8, 14.10.6, or 15.1. Alternatively, manually update the permissions of the `Mail.MailConfig` page so that only trusted users can view, edit, and delete it.
Original NVD description (English source)
XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and view and edit the mail sending configuration, including the smtp domain name and credentials. The problem has been patched in XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, the rights of the `Mail.MailConfig` page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the `XWiki.XWikiAdminGroup` group).