Description

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T16:19:47.967Z",
  "pubdate": "2026-08-10T16:19:47.967Z",
  "executiveSummary": "An information disclosure vulnerability exists in the XWiki Platform, specifically stemming from an insufficient previous patch for GHSA-5cf8-vrr8-8hjm.\nThe vulnerability allows an unauthorized or low-privileged attacker to systematically extract sensitive user data, specifically password salts and password hashes, one bit at a time.\nThe flaw affects the XWiki Platform starting from version 6.2.1 and prior to versions 16.10.17, 17.4.9, 17.10.13, and 18.0.0RC1.\nBy issuing slightly modified parameters to the LiveTableResults component, an attacker can perform oracle-based or timing-based inference attacks.\nSuccessful exploitation requires exactly 768 requests to completely retrieve a user's password salt and hash, posing severe credential compromise risks across affected wiki deployments.\nThe vulnerability can be remediated by upgrading to the patched versions or by manually applying the patch to the XWiki.LiveTableResultsMacros wiki page.",
  "technicalDetails": "The root cause of the vulnerability lies in an incomplete prior patch (GHSA-5cf8-vrr8-8hjm) designed to restrict unauthorized access to sensitive user properties, such as passwords and email properties, via the LiveTableResults query mechanism.\nThe vulnerable component is the XWiki.LiveTableResultsMacros wiki page, which handles dynamic data queries and rendering for LiveTables.\nAffected versions span from version 6.2.1 up to, but not including, 16.10.17, 17.4.9, 17.10.13, and 18.0.0RC1.\nThe attack vector involves sending crafted HTTP requests containing slightly modified parameters targeting the LiveTableResults interface.\nExploitation occurs via a side-channel or boolean-based inference technique, allowing the attacker to determine the exact characters or bits of internal database fields (specifically password salts and cryptographic hashes).\nThe attack flow proceeds iteratively: the attacker sends malicious parameters designed to evaluate specific boolean conditions against the target user's password hash and salt values. Based on the application response or rendering behavior, the attacker infers whether the evaluated bit or character is correct.\nBy repeating this process systematically, an attacker can extract the complete password salt and hash within approximately 768 requests.\nOnce the password salt and hash are fully retrieved, the attacker can offline attempt brute-force or dictionary cracking attacks to recover the plaintext credentials, potentially leading to unauthorized privilege escalation and system compromise.\nThe vulnerability is exploitable remotely over the network, potentially without requiring complex authentication privileges, depending on the default LiveTable exposure configurations."
}