GHSA-5cf8-vrr8-8hjm XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor

• Maven org.xwiki.platform:xwiki-platform-livetable-ui: >= 3.2-m3, < 13.4.4 → fixed in 13.4.4 • Maven org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki: >= 3.2-m3, < 13.4.4 → fixed in 13.4.4 • Maven org.xwiki.platform:xwiki-platform-livetable-ui: >= 13.5.0, < 13.10.9 → fixed in 13.10.9 • Maven org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki: >= 13.5.0, < 13.10.9 → fixed in 13.10.9 • Maven org.xwiki.platform:xwiki-platform-livetable-ui: >= 14.0.0, < 14.7-rc-1 → fixed in 14.7-rc-1 • Maven org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki: >= 14.0.0, < 14.7-rc-1 → fixed in 14.7-rc-1

Impact Users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. Patches The issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9. Workarounds The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, and 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`. References • Jira: https://jira.xwiki.org/browse/XWIKI-19949 • Patch: https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki.org • Email us at Security Mailing List