Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.platform:xwiki-platform-mail-send-default

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.9MavenPublished

    XWiki Platform's Mail.MailConfig can be edited by any user with edit rights

    CVE-2023-34465 · GHSA-g75c-cjr6-39mc

    Affected
    • Maven org.xwiki.platform:xwiki-platform-mail-send-default >= 11.8-rc-1, < 14.4.8; >= 14.5, < 14.10.6; >= 15.0-rc-1, < 15.1
    Fixed in
    15.114.10.614.4.8· Vendor fix available
    Issue
    Impact Mail.MailConfig can be edited by any logged-in user by default. Consequently, they can: - change the mail obfuscation configuration - view and edit the mail sending configuration, including the smtp domain name and credentials. Patches The problem has been patched on XWiki 14.4.8, 15.1, and 14.10.6. Workarounds The rights of the Mail.MailConfig page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the XWiki.XWikiAdminGroup group). On 14.4.8+, 15.1-rc-1+, or 14.10.5+, if at startup Mail.MailConfig does not have any rights defined, view, edit and delete rights are automatically granted to the XWiki.XWikiAdminGroup group. See the corresponding patch. References - https://jira.xwiki.org/browse/XWIKI-20519 + https://jira.xwiki.org/browse/XWIKI-20671 - https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4 - https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1 For more…

    Recommended action: Upgrade to 15.1, 14.10.6 or 14.4.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →