Solr search discloses password hashes of all users
Impact
The Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. To reproduce, it is sufficient to search for propertyvalue:?* AND reference:*.password and then deselect the "Document" property under "Result type" in the "Refine your search" widget at the right of the search results. If this displays any passwords or password hashes, the installation is vulnerable.
By default, passwords in XWiki are salted and hashed with SHA-512. On XWiki versions affected by CVE-2022-41933, passwords are stored in plain text if they have been set using the password reset feature. This might affect XWiki installations that are using an external authentication mechanism such that passwords aren't stored in the wiki.
This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text.
Patches
This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. This vulnerability has been patched as part of patching GHSA-2grh-gr37-2283, the part of the fix that changes the indexing of single properties to use the same code as the main document for getting the property's value fixes this vulnerability.
Workarounds
We're not aware of any workarounds apart from upgrading to a fixed version.
References
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | org.xwiki.platform:xwiki-platform-search-solr-api | >= 7.2-milestone-2, < 14.10.15, >= 15.0-rc-1, < 15.5.2, >= 15.6-rc-1, < 15.7-rc-1 | 14.10.15, 15.5.2, 15.7-rc-1 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Debilidad (CWE)
CWE-200, CWE-312- Plataforma
- Java / Kotlin (Maven)
- Paquete
org.xwiki.platform:xwiki-platform-search-solr-api- Publicada
- 16.12.2023
- Actualizado
- 11.10.2026 13:20
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-p6cp-6r35-32mh - CC BY 4.0
Historial de vulnerabilidades: org.xwiki.platform:xwiki-platform-search-solr-api
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 3
- Primera → última
- 12.2023 04.2025
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 1
- Media 1
- Baja 1
Divulgaciones por año
- 2023: 2
- 2024: 0
- 2025: 1
- 2026: 0
-
Solr search discloses password hashes of all users esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.