| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-livetable-ui | ≥ 13.5.0, < 13.10.9≥ 14.0.0, < 14.7-rc-1≥ 3.2-m3, < 13.4.4 | 13.10.914.7-rc-113.4.4 |
| org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki | ≥ 13.5.0, < 13.10.9≥ 14.0.0, < 14.7-rc-1≥ 3.2-m3, < 13.4.4 | 13.10.914.7-rc-113.4.4 |
| xwiki | = 14.7= 3.2≥ 13.5.0, < 13.10.9≥ 14.0, < 14.7≥ 3.3, < 13.4.4 | 13.10.914.713.4.4 |
Users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros.
The issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9.
The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, and 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on LiveTableResults and WikisLiveTableResultsMacros.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free