CVE-2023-48241
HIGHEPSS 99th pctlDescription
XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wikis to anybody who has access to it, by default it is public. This exposes all information stored in the wiki (but not some protected information like password hashes). While there is a right check normally, the right check can be circumvented by explicitly requesting fields from Solr that don't include the data for the right check. This has been fixed in XWiki 15.6RC1, 15.5.1 and 14.10.15 by not listing documents whose rights cannot be checked. No known workarounds are available.
How to fix
TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploit Intelligence
Very high risk: more likely to be exploited than 99% of all known CVEs.
References
Related Vulnerabilities
Other CWE-285 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2025-29927 | Critical | 9.1 | 99% | - | Fix |
| CVE-2023-32707 | High | 8.8 | 79% | - | Fix |
| CVE-2021-28799 | Critical | 10.0 | 78% | KEV + Ransom | Fix |
| CVE-2023-22480 | High | 7.3 | 67% | - | Fix |
| CVE-2022-3229 | Critical | 9.8 | 66% | - | - |
| CVE-2016-5676 | High | 7.5 | 54% | - | - |
Common questions
How do I fix CVE-2023-48241?
Upgrade xwiki to 15.5.1 or later.
Is CVE-2023-48241 being actively exploited?
Not that we know of. CVE-2023-48241 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 72.8% is the estimated probability that it will be exploited in the next 30 days. That is higher than 99% of all scored CVEs.
How severe is CVE-2023-48241?
CVE-2023-48241 has a CVSS v3 base score of 7.5, rated high. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.
What does CVE-2023-48241 affect?
Published advisories record a fix for xwiki (NVD). Only products with a sourced advisory are listed, so treat this as what we can cite rather than a complete inventory.
Embed a live status badge for CVE-2023-48241
Markdown
[](https://tridentstack.com/cve/CVE-2023-48241)HTML
<a href="https://tridentstack.com/cve/CVE-2023-48241"><img src="https://tridentstack.com/cve/badge/CVE-2023-48241.svg" alt="CVE-2023-48241"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.