{"id":"CVE-2023-34465","aliases":["GHSA-g75c-cjr6-39mc"],"url":"https://o3.security/vulnerability/CVE-2023-34465","summary":"XWiki Platform's Mail.MailConfig can be edited by any user with edit rights","details":"### Impact\n\n`Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can:\n- change the mail obfuscation configuration\n- view and edit the mail sending configuration, including the smtp domain name and credentials.\n\n### Patches\nThe problem has been patched on XWiki 14.4.8, 15.1, and 14.10.6.\n\n### Workarounds\nThe rights of the `Mail.MailConfig` page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the `XWiki.XWikiAdminGroup` group).\nOn 14.4.8+, 15.1-rc-1+, or 14.10.5+, if at startup `Mail.MailConfig` does not have any rights defined, `view`, `edit ` and `delete` rights are automatically granted to the `XWiki.XWikiAdminGroup` group.\nSee the corresponding [patch](https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4).\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-20519 + https://jira.xwiki.org/browse/XWIKI-20671\n- https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4\n- https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1\n\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n*    Email us at [Security Mailing List](mailto:security@xwiki.org)","published":"2023-06-23T15:07:59.732Z","modified":"2026-08-12T14:51:05.554586Z","cvss":{"score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-mail-send-default","fixedVersion":"14.4.8"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-mail-send-default","fixedVersion":"14.10.6"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-mail-send-default","fixedVersion":"15.1"}],"fix":{"url":"https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1","label":"xwiki/xwiki-platform@8910b88"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20519"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20671"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34465.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g75c-cjr6-39mc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34465"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T14:51:05.554586Z"}}