XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-rest-server(Maven) | 7.3-milestone-1 | 14.4.8 | N/A |
| org.xwiki.platform:xwiki-platform-rest-server(Maven) | 14.5 | 14.10.6 | N/A |
| org.xwiki.platform:xwiki-platform-rest-server(Maven) | 15.0-rc-1 | 15.1 | N/A |
CVSS Metrics
