GitHub Advisoryadvisory · Maven

GHSA-rh28-mqj4-8x59 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

HIGH Published 2026-05-26 Modified 2026-05-26 Official page ↗
Aliases
CVE-2026-48048
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-livetable-ui
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-359
Reviewed
2026-05-26

Affected packages

• Maven org.xwiki.platform:xwiki-platform-livetable-ui: >= 6.2.1, < 16.10.17 → fixed in 16.10.17 • Maven org.xwiki.platform:xwiki-platform-livetable-ui: >= 17.0.0-rc-1, < 17.4.9 → fixed in 17.4.9 • Maven org.xwiki.platform:xwiki-platform-livetable-ui: >= 17.5.0-rc-1, < 17.10.3 → fixed in 17.10.3

Description

Impact XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient and with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. Patches The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. Workarounds The patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`. Resources • https://jira.xwiki.org/browse/XWIKI-23875 • https://github.com/xwiki/xwiki-platform/commit/c4442716b02ffcdaa9d5e703b1db6203e36456fa

Related

Alias · CVE (1)

  • CVE-2026-48048 XWiki Platform is a generic wiki platform. vulnerability

Weakness · CWE (1)

  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor weakness

References