CVE-2023-38509

XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10.9 and 15.3-rc-1, the mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. This has been patched in XWiki 14.10.9 and XWiki 15.3-rc-1. A workaround is to modify the page `XWiki.LiveTableResultsMacros` following the patch.

• CWE-402

• https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0
• https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0cPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g9w4-prf3-m25gThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-20601Exploit, Issue Tracking, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0
• https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0cPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g9w4-prf3-m25gThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-20601Exploit, Issue Tracking, Vendor Advisory

Published

Nov 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38503Directus is a real-time API and App dashboard for managing S…6.5
• CVE-2023-38504Sails is a realtime MVC Framework for Node.js. In Sails apps…7.5
• CVE-2023-38505DietPi-Dashboard is a web dashboard for the operating system…7.5
• CVE-2023-38506Joplin is a free, open source note taking and to-do applicat…5.4
• CVE-2023-38507Strapi is the an open-source headless content management sys…9.8
• CVE-2023-38508Tuleap is an open source suite to improve management of soft…4.3
• CVE-2023-38510Tolgee is an open-source localization platform. Starting in …8.1
• CVE-2023-38511iTop is an IT service management platform. Dashboard editor…4.3
• CVE-2023-38512Cross-Site Request Forgery (CSRF) vulnerability in wpstream …8.8
• CVE-2023-38513Authorization Bypass Through User-Controlled Key vulnerabili…5.4
• CVE-2023-38514Missing Authorization vulnerability in social share pro Soci…4.3
• CVE-2023-38515Server-Side Request Forgery (SSRF) vulnerability in Andy Moy…4.9