How severe is CVE-2023-34467?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.5 out of 10.

What type of vulnerability is CVE-2023-34467?

This is classified as CWE-402, which is a common weakness in software security.

CVE-2023-34467 - HIGH Severity | CVSS 7.5

Vulnerability Description

XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end user was obfuscated, the rest response was also containing the mail unobfuscated and users were able to filter and sort on the unobfuscated, allowing them to infer the mail content. The consequence was the possibility to retrieve the email addresses of all users even when obfuscated. This has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.

Related Vulnerabilities

CVE-2021-23263

HIGH

CVSS:7.5(High)

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).

CWE-4022021

CVE-2021-31407

HIGH

CVSS:7.5(High)

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application c...

CWE-4022021

CVE-2021-31410

HIGH

CVSS:7.5(High)

Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request.

CWE-4022021

CVE-2022-3596

HIGH

CVSS:7.5(High)

An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leadi...

CWE-4022022

CVE-2024-29900

HIGH

CVSS:7.5(High)

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js hea...

CWE-4022024

CVE-2025-32360

HIGH

CVSS:8.1(High)

In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared dra...

CWE-4022025