| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-livetable-ui | ≥ 15.0, < 15.3-rc-1≥ 3.5-milestone-1, < 14.10.9 | 15.3-rc-114.10.9 |
| xwiki | ≥ 3.5, < 14.10.9 | 14.10.9 |
The mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails.
See https://jira.xwiki.org/browse/XWIKI-20601 for the reproduction steps.
This has been patched in XWiki 14.10.9, and XWiki 15.3-rc-1.
The workaround is to modify the page XWiki.LiveTableResultsMacros following this patch.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free