CVE-2023-50719— XWiki Platform Solr search discloses password hashes of all users
Quick assessment
Affected
xwiki xwiki-platform
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
XWiki Platform是XWiki基金会的一套用于创建Web协作应用程序的Wiki平台。 XWiki 存在安全漏洞，该漏洞源于 XWiki 中基于 Solr 的搜索会向任何有权查看相应用户配置文件的人公开所有用户的密码哈希值。
Public Exploits 1
Nuclei · 1
CVE-2023-50719.yaml [template]
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-50719
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
XWiki Platform Solr search discloses password hashes of all users
Source: CVE Program / CVE List V5
Vulnerability Description
XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text. This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
侵犯隐私
Source: CVE Program / CVE List V5
Vulnerability Title
XWiki Platform 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Platform是XWiki基金会的一套用于创建Web协作应用程序的Wiki平台。 XWiki 存在安全漏洞，该漏洞源于 XWiki 中基于 Solr 的搜索会向任何有权查看相应用户配置文件的人公开所有用户的密码哈希值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-platform | >= 7.2-milestone-2, < 14.10.15 | - |
|
II. Public POCs for CVE-2023-50719
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text. This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50719.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-50719
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-50719 (1)
Vendor Advisories for CVE-2023-50719 (1)
-
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p6cp-6r35-32mh x_refsource_CONFIRM
Other References for CVE-2023-50719 (1)
-
https://jira.xwiki.org/browse/XWIKI-21208 x_refsource_MISC
Same Patch Batch · xwiki · 2023-12-15 · 5 CVEs total
| CVE-2023-50721 | 10.0 CRITICAL | XWiki Platform RCE from account through SearchAdmin |
| CVE-2023-50723 | 10.0 CRITICAL | XWiki Platform remote code execution/programming rights with configuration section from an |
| CVE-2023-50722 | 9.7 CRITICAL | XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass |
| CVE-2023-50720 | 5.3 MEDIUM | XWiki Platform Solr search discloses email addresses of users |
IV. Related Vulnerabilities
Same product: xwiki-platform
-
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w -
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h -
CVE-2026-33229
XWiki Platform affected by remote code execution with script
Same vendor: xwiki
-
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w -
CVE-2026-23734
XWiki Platform: Path traversal via resources parameter in ss -
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h
Same weakness: CWE-359
-
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-24078
Exposure of Private Personal Information to an Unauthorized -
CVE-2026-56171
Windows Remote Desktop Protocol (RDP) Information Disclosure -
CVE-2026-50657
Microsoft Defender for Endpoint for Mac Information Disclosu -
CVE-2026-58297
Microsoft Edge for Android Information Disclosure Vulnerabil
V. Comments for CVE-2023-50719
No comments yet